11 ms·

you might want to read up on the controversies surrounding him first though

by ru999gol 7y ago

dexterdog 7y ago
Do you mean because he's arrogant? Who cares? The software is great and saves me a ton of time and money.
- eeZah7Ux 7y ago
  I care. As developers we have the moral responsibility of not putting people at risk even if we don't have the legal one. The author has zero care for security and the product had plenty of vulnerabilities. This harms users and also other people. Furthermore, poor behaviors attracts blame on the whole open source community.
  - mmsimanga 7y ago
    Fork it.
    - eeZah7Ux 7y ago
      The codebase is horrible. I use something else.
      - nieve 7y ago
        A something else that you're avoiding naming?
        eeZah7Ux 7y ago
        Yes, it's not released (yet).
  - michaelmrose 7y ago
    When you interact with customer service as a paying customer you get to expect courtesy. Some people seem to expect obsequiousness but I digress. By what chain of reasoning do you derive the existence of the moral obligation to users who have paid exactly nothing let alone the obligation to consider what the broader world thinks of open source developers. It's pretty clear Kovid is a bit of an asshole and sometimes outspokenly incorrect but what right do we have to demand different? Usually such an obligation is transactional. Even if unspoken and devoid of monetary context there is some broader context SOMETHING of value is gained or lost. So far as I can see the only thing we give Kovid is attention which is cheap and he gives us work which is dear. If you don't agree that the present transaction of putting up with the existence of opinionated posts which you don't have to read for a useful piece of software you don't actually have to use it. It would even be useful for you to expand on why you think its insecure because that may inform users who can then see to their own interests better for having the benefit of your counsel but don't bore us with talk of his moral obligation unless you can't substantiate such. The spoiler alert is that you cannot because you have confused the right to control the mores of a particular community with the right to impose those on non-members.
    - hombre_fatal 7y ago
      I don't think being a paying customer changes much here either unless there's some sort of explicit customer support package in the deal, especially when we're just talking about donors. I once made the mistake of accepting donations for a forum I run and learned how people will expect the world from you, like 1:1 customer support whenever they need it, just because they once gave me $5. Eventually all the "this is outrageous, I am a paying customer!" made me refund everyone and I never accepted donations again.
    - eeZah7Ux 7y ago
      It is sad to see how you equate moral obligation to transactions. But if you really need to see transactions everywhere, here's one: When I give software away for free (which I do) or food (which I do) people give me something in exchange: their trust. I also give my trust to other software developers. Not caring of security is a breach of such trust. Same as giving someone some spoiled food.
AdmiralAsshat 7y ago
If you're referring to the "I'll personally maintain Python 2 if it goes EOL" comment, Calibre has been slowly upgrading to Python 3.
- GrayShade 7y ago
  It hasn't been upgrading to Python 3 by itself but through the effort of a distro maintainer and other contributors: https://github.com/kovidgoyal/calibre/pulls?q=is%3Apr+author%3Aeli-schwartz https://github.com/kovidgoyal/calibre/pulls?q=is%3Apr+author....
  - AdmiralAsshat 7y ago
    That is kinda the point of being an open source project, though, isn't it? The lead dev says, "It's going to be way too difficult for me to convert this codebase to Python 3, I don't want to do it." A group of volunteers then decide to undertake the effort themselves because they wish to ensure the project's continued viability for the future. AFAIK, he hasn't nixed the idea completely if others are handling the legwork.
    - GrayShade 7y ago
      Did he put any effort into the Python 3 port, or is his merit just that he didn't reject the PRs that others have worked on?
      - padraic7a 7y ago
        If you look at the github he is actively involved, and is fixing problems that the porters run in to.
ninjin 7y ago
You might want to add some specifics and references to back up such a statement. Otherwise it very much looks like a fairly cheap character attack to an outsider such as myself.
- kranner 7y ago
  https://bugs.launchpad.net/calibre/+bug/853934 https://bugs.launchpad.net/calibre/+bug/853934
  - the_af 7y ago
    Where's the controversy? A maintainer and a contributor disagreeing about a bug report, and it gets a bit heated. Nothing important to see there, and nothing we haven't seen a thousand times in public bug trackers.
    - kranner 7y ago
      There are many other such instances in which the lead dev immediately responds to bug reports with 'works on my machine' without even asking for details to reproduce the bug. Any further words from the bug reporter are met with sarcasm or words worse than I would term "a bit heated". Here's Kovid responding to reports of security vulnerabilities: https://bugs.launchpad.net/calibre/+bug/885027 https://bugs.launchpad.net/calibre/+bug/885027
      - thrower123 7y ago
        How much, exactly, are any of these people reporting bugs paying for this software? You use open source software that is made by one guy and offered to the world for free, you kind of have to deal with the possibility that that guy has better things to do than fuss over every bug report.
        kranner 7y ago
        I have no way of knowing how much these people paid, if anything, to the dev's Patreon or Liberapay or Donate to PayPal. What they did do was spend their time reporting serious issues for zero payment. Bugs are important to fix, some bugs can be critically important to fix. If the dev chooses to fix these bugs, it is the dev that will receive all credit for doing so. The person who made the effort (albeit minor in comparison) of reporting the issue will not be credited or acknowledged in any way. Also, I think a vulnerability that allows unprivileged users to gain root on a system on which Calibre is installed is worth fussing over.
asxd 7y ago
From the sibling comments, it seems like you're just referring to his history of abrasive social interactions on bug tickets. Granted it is strikingly abrasive, but that really isn't a good reason to forego donating. At the very least don't actively convince others not to donate.

you might want to read up on the controversies surrounding him first though

dexterdog 7y ago

Do you mean because he's arrogant? Who cares? The software is great and saves me a ton of time and money.

eeZah7Ux 7y ago
I care. As developers we have the moral responsibility of not putting people at risk even if we don't have the legal one. The author has zero care for security and the product had plenty of vulnerabilities. This harms users and also other people. Furthermore, poor behaviors attracts blame on the whole open source community.
- mmsimanga 7y ago
  Fork it.
  - eeZah7Ux 7y ago
    The codebase is horrible. I use something else.
    - nieve 7y ago
      A something else that you're avoiding naming?
      - eeZah7Ux 7y ago
        Yes, it's not released (yet).
- michaelmrose 7y ago
  When you interact with customer service as a paying customer you get to expect courtesy. Some people seem to expect obsequiousness but I digress. By what chain of reasoning do you derive the existence of the moral obligation to users who have paid exactly nothing let alone the obligation to consider what the broader world thinks of open source developers. It's pretty clear Kovid is a bit of an asshole and sometimes outspokenly incorrect but what right do we have to demand different? Usually such an obligation is transactional. Even if unspoken and devoid of monetary context there is some broader context SOMETHING of value is gained or lost. So far as I can see the only thing we give Kovid is attention which is cheap and he gives us work which is dear. If you don't agree that the present transaction of putting up with the existence of opinionated posts which you don't have to read for a useful piece of software you don't actually have to use it. It would even be useful for you to expand on why you think its insecure because that may inform users who can then see to their own interests better for having the benefit of your counsel but don't bore us with talk of his moral obligation unless you can't substantiate such. The spoiler alert is that you cannot because you have confused the right to control the mores of a particular community with the right to impose those on non-members.
  - hombre_fatal 7y ago
    I don't think being a paying customer changes much here either unless there's some sort of explicit customer support package in the deal, especially when we're just talking about donors. I once made the mistake of accepting donations for a forum I run and learned how people will expect the world from you, like 1:1 customer support whenever they need it, just because they once gave me $5. Eventually all the "this is outrageous, I am a paying customer!" made me refund everyone and I never accepted donations again.
  - eeZah7Ux 7y ago
    It is sad to see how you equate moral obligation to transactions. But if you really need to see transactions everywhere, here's one: When I give software away for free (which I do) or food (which I do) people give me something in exchange: their trust. I also give my trust to other software developers. Not caring of security is a breach of such trust. Same as giving someone some spoiled food.

AdmiralAsshat 7y ago

If you're referring to the "I'll personally maintain Python 2 if it goes EOL" comment, Calibre has been slowly upgrading to Python 3.

GrayShade 7y ago
It hasn't been upgrading to Python 3 by itself but through the effort of a distro maintainer and other contributors: https://github.com/kovidgoyal/calibre/pulls?q=is%3Apr+author%3Aeli-schwartz https://github.com/kovidgoyal/calibre/pulls?q=is%3Apr+author....
- AdmiralAsshat 7y ago
  That is kinda the point of being an open source project, though, isn't it? The lead dev says, "It's going to be way too difficult for me to convert this codebase to Python 3, I don't want to do it." A group of volunteers then decide to undertake the effort themselves because they wish to ensure the project's continued viability for the future. AFAIK, he hasn't nixed the idea completely if others are handling the legwork.
  - GrayShade 7y ago
    Did he put any effort into the Python 3 port, or is his merit just that he didn't reject the PRs that others have worked on?
    - padraic7a 7y ago
      If you look at the github he is actively involved, and is fixing problems that the porters run in to.

ninjin 7y ago

You might want to add some specifics and references to back up such a statement. Otherwise it very much looks like a fairly cheap character attack to an outsider such as myself.

kranner 7y ago
https://bugs.launchpad.net/calibre/+bug/853934 https://bugs.launchpad.net/calibre/+bug/853934
- the_af 7y ago
  Where's the controversy? A maintainer and a contributor disagreeing about a bug report, and it gets a bit heated. Nothing important to see there, and nothing we haven't seen a thousand times in public bug trackers.
  - kranner 7y ago
    There are many other such instances in which the lead dev immediately responds to bug reports with 'works on my machine' without even asking for details to reproduce the bug. Any further words from the bug reporter are met with sarcasm or words worse than I would term "a bit heated". Here's Kovid responding to reports of security vulnerabilities: https://bugs.launchpad.net/calibre/+bug/885027 https://bugs.launchpad.net/calibre/+bug/885027
    - thrower123 7y ago
      How much, exactly, are any of these people reporting bugs paying for this software? You use open source software that is made by one guy and offered to the world for free, you kind of have to deal with the possibility that that guy has better things to do than fuss over every bug report.
      - kranner 7y ago
        I have no way of knowing how much these people paid, if anything, to the dev's Patreon or Liberapay or Donate to PayPal. What they did do was spend their time reporting serious issues for zero payment. Bugs are important to fix, some bugs can be critically important to fix. If the dev chooses to fix these bugs, it is the dev that will receive all credit for doing so. The person who made the effort (albeit minor in comparison) of reporting the issue will not be credited or acknowledged in any way. Also, I think a vulnerability that allows unprivileged users to gain root on a system on which Calibre is installed is worth fussing over.

asxd 7y ago

From the sibling comments, it seems like you're just referring to his history of abrasive social interactions on bug tickets. Granted it is strikingly abrasive, but that really isn't a good reason to forego donating. At the very least don't actively convince others not to donate.