Remote

David Lord

@davidism@mas.to

mastodon 4.7.2

Lead maintainer of Flask, Jinja, Click, and others on Pallets. @ThePSF@fosstodon.org Fellow. he/they

1896 Followers

268 Following

47 Posts

Joined November 07, 2022

Website:

https://davidism.com

GitHub:

https://github.com/davidism

Bluesky:

https://bsky.app/profile/davidism.bsky.social

@davidism@mas.to

· 2w ago

I've turned off pull requests from non-members for Flask, Werkzeug, Jinja, and Click this week, and have enjoyed not waking up to a fresh wave of AI junk every morning. I think I'm going to update our contributing guide to say "introduce yourself and how you use the library in chat first if you want to contribute pull requests". Sad that we had to go here, but aside from conference sprints we weren't really getting outside contribution anyway (which is also sad, but that's been the case a lot longer than AI has been around). #python #flask #opensource

379

0

185

1

@davidism@mas.to

· 6d ago

Boosted by @trending@homestead.social

RE: https://mas.to/@davidism/117292399049862157 The beginning of the month, when every junk producer's token limit resets, and we get a whole new wave of junk. Turning off PRs helped a lot, but they just started opening "test issue, checking if my API access is broken", or commenting or emailing their patches instead. I really wish I knew how to escape this without turning off community interaction entirely. #python #flask #opensource

Quoting

@davidism@mas.to

I've turned off pull requests from non-members for Flask, Werkzeug, Jinja, and Click this week, and have enjoyed not waking up to a fresh wave of AI junk every morning. I think I'm going to update our contributing guide to say "introduce yourself and how you use the library in chat first if you want to contribute pull requests". Sad that we had to go here, but aside from conference sprints we weren't really getting outside contribution anyway (which is also sad, but that's been the case a lot longer than AI has been around). #python #flask #opensource

Open quoted post

David Lord :python:: "I've turned off pull requests from non-members fo…" - mas.to

31

0

35

0

@davidism@mas.to

· 6mo ago

company making maintainer work easier is now owned by company making that work harder https://astral.sh/blog/openai #Python

Astral to join OpenAI

Astral to join OpenAI

Astral has entered into an agreement to join OpenAI as part of the Codex team.

76

9

67

1

@davidism@mas.to

· 5mo ago

Click through the pages of closed pull requests for Flask. It's not until page 9 (end of 2024) that you see a majority are merged instead of closed. Only 38 of the last 200 PRs are merged. Similar story for Werkzeug, Jinja, and Click. LLMs and genAI are such an obvious negative on maintainer time. https://github.com/pallets/flask/pulls?page=9&q=is%3Apr+is%3Aclosed

48

12

40

1

@davidism@mas.to

· 7mo ago

Most security reports could be a couple sentences and a small code snippet, and would be better for it. I hate that every report is written as if it were a blog post about their finding and how it's the greatest disaster of all time. Write as if you're having a dialog with a knowledgeable maintainer, wait for questions to elaborate if needed. LLMs have not made this better either.

29

4

9

0

@davidism@mas.to

· 5mo ago

North Bay Python begins! And what's that logo in the background? Yep, Pallets and Flask is sponsoring the conference, to give back to the great community that I look forward to visiting every year ❤️ #nbpy #python #flask

16

0

7

0

@davidism@mas.to

· 5mo ago

I brewed a witbier and am bring some cans for North Bay Python attendees. Limited supply! 👀 #NBPy

15

2

1

0

@davidism@mas.to

· 5mo ago

Yeah, Pallets and Flask sponsored North Bay Python! But I know you all actually want the cat pics from my slides 🐈‍⬛🐈‍⬛ Here's a link to the slides in blog form: https://davidism.com/sponsoring-north-bay-python-2026/ #nbpy #python #flask

14

1

10

0

@davidism@mas.to

· 5mo ago

Road trip from San Diego to Petaluma for North Bay Python! With our six month old! In the longest trip in our Ioniq 5 yet! We’re totally fine! #NBPy

14

0

0

0

@davidism@mas.to

· 5mo ago

"So why didn't you use Click?" ... "It just didn't click with me." @pathunstrom@ngmx.com @astraluma@tacobelllabs.net I clapped. #nbpy #flask

13

0

4

0

@davidism@mas.to

· 5mo ago

Web app db design: if you have optional string fields, do you make the column nullable, or not nullable with a default empty string. Consider HTML form data (empty field is sent as empty string, not omitted), and rendering (rendering empty for None has to be remembered everywhere). I've never seen any consensus. Comment if you want to explain why you choose one over the other! #python #flask #django :boostplease:

mas.to

10

21

8

1

@davidism@mas.to

· 5mo ago

RE: @MaggieFero@hachyderm.io

North Bay Python lunch has turned into everyone pointing at birds and saying "Bird!". I just pledged $4/per bird to our local conference team @MaggieFero@hachyderm.io and @phildini@wandering.shop, help them raise money with birds! #nbpy #python

Margaret Fero: "This weekend I'm going to be counting the bird sp…" - Hachyderm.io

10

1

6

0

@davidism@mas.to

· 5mo ago

Replying to

@mitsuhiko why should OSS change? It’s not me that’s doing something new that harms my projects, it’s everyone who’s enthusiastic or center using something poorly. I’d be ecstatic if they all became trustworthy expert contributors, but that’s on them to prove, not me. And in the meantime I have to deal with the junk.

10

0

0

0

@davidism@mas.to

· 5mo ago

Replying to

Turns out we already have that in our security policy, and people just ignore it. What a surprise 🙄 https://palletsprojects.com/security I added another sentence to make it even clearer.

palletsprojects.com

8

1

1

0

@davidism@mas.to

· 5mo ago

Replying to

@mitsuhiko LLMs have increased the amount of junk and the work needed to moderate it, but have not increased the amount of good contributors or maintainers. It's hard to keep engaging with or even just passively reading people who are enthusiastic or center on LLMs, when my daily experience paints such a different picture and forecast.

9

0

1

0

@davidism@mas.to

· 5mo ago

Clapping every time the projector detects the laptop. It's trying its best. #nbpy

7

1

1

0

@davidism@mas.to

· 7mo ago

It's really hard to hear about how helpful LLMs are when I deal with the opposite multiple times per day now. There are techniques experienced developers use to get better LLM results, but that's not simple and so approximately no one does it. Everyone who talks about how to use them correctly is a rounding error compared to the total number using them.

12

4

3

0

@davidism@mas.to

· 7mo ago

"Stop using LLMs to generate output at us." Multiple times per day now, we get issues, comments, and PRs that are clearly copy paste LLM output, with no apparent care or interest in the project and community. They all sound the same, the initial post, the way they respond to feedback, walls of text with 5 subheadings even for 1 line docs changes. Every user profile is the same, one or more of: 1 month old, a giant flashy readme with no substance, 1000 PRs opened yesterday.

12

1

7

0

@davidism@mas.to

· 5mo ago

Replying to

@demiurg people will submit junk regardless of what's in the contributing guide. This was true before genAI too, it just enabled faster junk production. We are updating our guide, so good contributors know what to avoid, but I have zero expectation that it will change the problem.

6

1

0

0

@davidism@mas.to

· 5mo ago

Rest and recharge, most of us are not working in an ER,. ... And it turns out running around panicked also doesn't produce good results in an actual ER. @baconandcoconut@freeradical.zone #nbpy

6

0

5

0

@davidism@mas.to

· 6mo ago

Replying to

@glyph @hynek Thanks both of you, these two comments helped me figure out what was going on: https://github.com/pallets/werkzeug/issues/3142

`get_host` should allow empty host · Issue #3142 · pallets/werkzeug

#3113 updated get_host to always validate the host characters. However, it also disallowed the empty string. This is a bit too strict, it should only validate the string if it's not empty, or if tr...

6

0

0

0

@davidism@mas.to

· 16mo ago

FlaskCon was a huge success! Thanks to all our amazing speakers, their talks, and our wonderful audience. The theme this year was overwhelmingly "live demos", and somehow they all went right. Was very rewarding to have a full room the entire time! Recordings will be up in the next week. #PyConUS #FlaskCon

mas.to

33

2

10

0

@davidism@mas.to

· 5mo ago

Replying to

@amethyst collective oof and wince from the audience

4

0

1

0

@davidism@mas.to

· 5mo ago

Replying to

@bagder@mastodon.social Unfortunately that hasn't made it to Flask yet, we still get a bunch of AI slop. About 50 reports so far this year, none helpful. Typically we get < 10 per year, some helpful.

4

0

0

0

@davidism@mas.to

· 5mo ago

Replying to

@demiurg I'd only consider it if I already knew and trusted the contributor, and it didn't look like every other generated PR.

3

1

0

0

@davidism@mas.to

· 7mo ago

Keynote by Brandon Sanderson "We Are The Art" https://www.youtube.com/watch?v=mb3uK-_QkOo

5

0

3

0

@davidism@mas.to

· 6mo ago

@NorthBayPython@social.northbaypython.org @chrisjrn@social.coop @robin@social.riley.pub my wife and I are planning to drive up with our 7 month old daughter 😊 Do you have any recommendations for kids things to do during the day, like library story time, parks, children's museums, etc?

3

1

1

0

@davidism@mas.to

· 5mo ago

Replying to

@zoul I have my own thoughts on detection, and manually vouching for everyone seems like a lot of work and a lot of commit churn. Would also be terrible for conference sprints.

2

1

0

0

@davidism@mas.to

· 5mo ago

RE: @davidism@mas.to

Was surprised how close this stayed. At a few points it was an even 50/50 split. No one picked the chaos option, which is a good sign. People made good arguments for both options. A little confusion over "default" whether that was at the SQL, form, or code level. I ended up picking "not null, default empty" for my current project because I don't need to distinguish "no response" from "empty response", so that simplifies typing. #python #flask #django

David Lord :python:: "Web app db design: if you have optional string fi…" - mas.to

2

1

1

0

@davidism@mas.to

· 6mo ago

@AlSweigart@mastodon.social huh, why does OEIS https://oeis.org/A000040 have so few? I bet there's some mailing list discussion somewhere explaining why

2

0

0

0

@davidism@mas.to

· 6mo ago

Replying to

@pathunstrom did JetBrains / PyCharm do something recently? All their AI stuff is plugin based, I have it all disabled and settings sync ensures they're disabled anywhere I install it. They do seem to be focusing on AI in general though.

2

4

0

0

@davidism@mas.to

· 18mo ago

FlaskCon call for proposals is open until April 17th, and we still need more submissions! Talk about Flask, Jinja, Click, Quart, HTMX, metrics, deployment, OpenAPI, Pydantic, GraphQL, internals, extensions, community, or anything else that might be related to Flask and the Pallets projects! #Python #Flask #PyConUS #FlaskCon https://flaskcon.com/2025/

12

0

20

0

@davidism@mas.to

· 7mo ago

I tried applying my own knowledge of where to start looking in a prompt to Claude Code: "Consider how rule matching is done by looking at Map.match in @src/werkzeug/routing/map.py and rule definition in @src/werkzeug/routing/rules.py. Does Rule.__eq__ adequately check for duplicate rules? How can it account for strict_slashes behavior?" Even with all that, it missed the true cause completely, in two fresh sessions. So you can't even rely on being an expert to successfully use AI.

2

1

0

0

@davidism@mas.to

· 5mo ago

Replying to

@ehashman@cloudisland.nz Going in, I thought I might be. But I was not, in fact, ready.

1

0

0

0

@davidism@mas.to

· 5mo ago

Replying to

@pamelafox@fosstodon.org how did they manage to release this a month ago with no one talking about it until now?! This has been a huge source of junk notifications since forever. Argh! It's per-repository, there's no org-level setting. 😭

1

4

0

0

@davidism@mas.to

· 18mo ago

FlaskCon is at PyCon US 2025, and we're currently looking for talk proposals! Anything related to Flask, Quart, Click, or Jinja; such as open source, community, web applications, monitoring, deployment, HTML, CSS, CLI, async, JavaScript, APIs, etc. Submit your talk proposal today: https://www.papercall.io/flaskcon-pyconus2025 #Python #Flask #PyConUS #FlaskCon

6

2

15

0

@davidism@mas.to

· 16mo ago

FlaskCon 2025 talks are now available to watch! https://www.youtube.com/playlist?list=PL-MSuSC-Kjb5QUUucArxREc8Ix3S1cPsk #Python #Flask #PyConUS2025 #FlaskCon

3

0

11

0

@davidism@mas.to

· 14mo ago

Replying to

@ubernostrum @hynek I really liked the article, I hadn’t looked closely at Litestar yet, and it’s always interesting to see patterns evolving like this. I’m with you, I’ve thought hard before on how Flask might evolve in this area. Maybe one day I'll be able to do it.

2

0

0

0

@davidism@mas.to

· 14mo ago

Replying to

@hynek @ubernostrum to be fair, you can use the same pattern in Flask/Quart that you like about Litestar, defining the view/lifecycle functions then importing them and registering them with one or more app and router (blueprint) later. Litestar makes that the main way to do things, and offers a nicer way to bulk register them. A Flask app can be structured that way as well, you don't _have_ to use the bound decorators.

1

2

0

0

@davidism@mas.to

· 18mo ago

Replying to

@brainwane Thanks! I updated the link to be the public event page, rather than the submission page.

1

0

0

0

@davidism@mas.to

· 18mo ago

Replying to

Check out last year's FlaskCon talks for some inspiration for your proposal! https://www.youtube.com/playlist?list=PL-MSuSC-Kjb6n0HsxU_knxCOLuToQm44z

1

0

0

0

@davidism@mas.to

· 47mo ago

Replying to

@mariatta @brettcannon @ayharano @__Chimaera It's way easier on the mobile app. The browser app makes a much bigger deal about a profile being on a different server for some reason.

2

0

0

0

@davidism@mas.to

· 5mo ago

Replying to

@stanfromireland I keep checking cpython and a few others. Flask seems to have been hit particularly hard. cpython might be a bit skewed because of how many PRs are automatic backports, but it still seems a lot healthier. Which is amazing given how much of a backlog there is, Flask has zero open issues and still gets this.

0

1

0

0

@davidism@mas.to

· 6mo ago

Replying to

@hynek what I'm not clear on is how Django has been doing this same check for 15 years. People must be deploying Django on AWS.

0

6

0

0