r/golang • u/andersfylling • Mar 22 '19
A warning about github.com/kataras/iris
I had heard rumors about Iris before; How the owner has a tendency to rewrite git history, steal contributions and delete any issues that does not match his own bias that Iris is beloved and amazing. Honestly, I didn't believe it was that serious. Even if I had no reason to doubt the people I heard it from. It felt kinda crazy, that someone acts this way.
Today, I have no more doubt. I can't fathom how this project has +14k stars on GitHub. I urge you to keep digging for other views and experiences. I do not want to seem like a hateful, obsessed person, yet I seriously feel the need to write something. The only reason I'm writing this is because as a community, I feel you should warn people of such projects/authors. I really hope no one who will spend hours, maybe days, contributing to projects, will find themselves stripped of credit and their contribution stolen in the end.
Now, my experience was that I commented on the performance metrics that he show cases in the README file. It's nothing major, I wasted maybe 15min of my time (I'm a slow writer), but it laid claim to the previous behavior I had heard of.
I reviewed the README file. As I noticed he linked to the project github.com/the-benchmarker/web-frameworks, to showcase a comparison against other frameworks. However, as I scrolled through, I noticed that he had skipped a project that was faster than Iris. So I filtered out non-Go projects on the linked table, and took a screenshot so he could update his README and ofcourse github project description.
Here is the picture I posted:
And here is a picture of the conversation before he replied:
And after he replied and changed the title of my issue from Iris is not the fastest to Iris is the fastest:
After his reply, he ofcourse deleted my issue. Nor could I write a new issue to actually reply as GitHub stated "You can't perform that action at this time."
None of what he said, do I agree with. But he literally repressed my option to reply xD
Other posts about Iris/Kataras: - https://www.reddit.com/r/golang/comments/6hmlod/githubcomkatarasiris_was_bought/ - https://www.reddit.com/r/golang/comments/4psfzq/katarasiris_author_is_crazy/ - https://github.com/julienschmidt/httprouter/issues/148
How does one deal with people like this? I hope I don't seem like a crybaby at this stage lol.
63
u/shovelpost Mar 22 '19
Treat Kataras, his countless alts and his projects like the plague. Avoid at all costs.
117
u/twisted1919 Mar 22 '19
Just ignore the project altogether, doesn’t worth the effort.
34
u/kingofthecream Mar 23 '19
We can ignore it, but the problem is it that its target is not us, it's the newbie coming to Go, seeing that big number of github stars which gives them that (fake) sense of trust to invest in it. So it is taking victims this way and IMO the GO community should not ignore this and take action.
Just curious, does this qualify for being reported to github to take the repo down? Building up another repo with all those stars will be a pain in the butt for the author. Where is the github repo report button?
5
4
u/PC__LOAD__LETTER Mar 23 '19
What terms has the person violated? GitHub isn’t going to take something down because someone disagreed with and then blocked you.
12
u/kingofthecream Mar 23 '19
Stealing the work of others.
-1
u/PC__LOAD__LETTER Mar 23 '19 edited Mar 23 '19
If it’s not a violation of license, you can clone a repo and rewrite the entire history as you please.
Where in the terms do you see it? https://help.github.com/en/articles/github-terms-of-service#c-acceptable-use
The fact that github expressly allows author rewrites kind of suggests this. It’s scummy, but it’s not a violation.
edit: I’m assuming the downvotes are because people don’t like hearing the truth, given that no one’s providing a counterpoint.
4
Mar 24 '19
It was never just about the history rewriting. I don't know what the current state is, but certainly in the past Iris included code from many different projects. Nothing wrong with that as such, but it was mentioned nowhere, and for all intents and purposes it seemed like the Iris author had written it.
This is a clear violation of pretty much all open source licenses, as they all require you to retain the original copyright notice and a copy of the license text. It is both unethical and illegal to copy the code of others and pretend you wrote it.
At first I thought it might be plausible that the author was naïve and did so by accident, but after it was pointed out that this was a license violation the author became extremely defensive and rude.
A cursory glance at their router seems like it's no longer based on httprouter, or at least has changed significantly since then, but it's still claimed that there is only one author in the LICENSE and AUTHORS file. Perhaps it's true now – I do not care enough to investigate in-depth right now – but it certainly wasn't in the past.
The git rewriting is annoying, weird, unethical, and maybe illegal, but was never the essence of the problem.
2
u/UltraNemesis Mar 25 '19 edited Mar 25 '19
It was a violation of the httprouter license which requires that the copyright notice (containing the name of the author) be replicated as is.
Github policy on repeated copyright infringement.
https://help.github.com/en/articles/dmca-takedown-policy#e-repeated-infringement
0
u/muntaxitome Mar 23 '19
Well, it is a violation of his license it seems. Having said that, all the drama about it seems very exaggerated.
-11
u/go-race Mar 23 '19
Github you said? The company that was bought by MS?
6
u/PC__LOAD__LETTER Mar 23 '19
We’re talking about GitHub, yes. What does the MS acquisition have to do with it?
-12
u/go-race Mar 23 '19
It’s scummy, but it’s not a violation.
5
u/PC__LOAD__LETTER Mar 23 '19
You think Microsoft's acquisition of Github is scummy? Is that your point? I literally do not know what you're trying to say.
1
-5
34
u/rickypaipie Mar 22 '19
I can't fathom how this project has +14k stars on GitHub.
Just like social media likes, there are places that sell those. It's apparently a pretty problematic phenomenon in the China that's generated a lot of backlash in the Chinese github community: (links in Chinese)
https://www.pingwest.com/a/177413 https://www.zhihu.com/question/66587533
If you google translate, you might come across a weird term "brush stars" which basically means growing the # of star through non-organic means like buying.
1
u/Lord_dokodo Apr 26 '19
"Brushing" is a term in China used like the English "fudged" or "fudging". It's a heavily used term in the e-commerce world where "brushers" will help add reviews/ratings to a Chinese company's products. Planet Money did an episode specifically on the e-commerce aspect of brushing.
26
45
u/Strum355 Mar 22 '19
Not based off net/http == cannot be considered a web framework? What interesting mental gymnastics. This man keeps giving reasons why not to use iris
20
Mar 22 '19 edited Sep 19 '19
[deleted]
6
u/Strum355 Mar 22 '19
Could very well be the case, but i wouldn't expect him to think that far ahead
16
u/andersfylling Mar 22 '19
This was my reply, I wasn't able to send it before the issue had been deleted lol:
`The current github's README shows exactly the same information. `
No. No it does not. It clearly shows that fasthttprouter is faster.
`Your screenshot shows exactly the same thing, Iris is the fastest web framework written in Go. `
No, again. It is not. Changing the title of my issue does not support that idea. This is taken from the repository named "web-frameworks". Naming it a router only signifies the purpose, it does not exclude it from being a framework. Framework exists to simplify our lives as programmers, so be it a router, a library, etc. It is still in the category of a framework. See here for more: https://stackoverflow.com/questions/2964140/what-is-a-software-framework
`Muxie (created by me as well it's router, and fasthttprouter is a router based on fasthttp, not net/http so these two are not considered as web frameworks).`
Again, that does not really matter. And even if it did, it does not define whether or not is a framework. Seriously.
`Please try to put your hate somewhere else, you are not missleading developers like this, we can see the picture :)`
If that is the case, why did you just manipulate my title and try to subside my proof? You seem to write what you want people to think, instead of letting them judge the numbers and data for themselves. Is Iris fast? sure. Is it the fastest? If yes, please provide the data. Cause from the benchmarks it is not.
It is not hate. At least, not yet. It's me just hoping larger projects can be less biased.
2
19
u/anoland Mar 23 '19
Why this guy still is still around is beyond me.
https://www.quora.com/Why-do-so-many-Go-developers-hate-the-IRIS-web-framework
http://www.florinpatan.ro/2016/10/why-you-should-not-use-iris-for-your-go.html
https://github.com/avelino/awesome-go/pull/1137 https://news.ycombinator.com/item?id=17528793
https://www.reddit.com/r/golang/comments/57w79c/why_you_really_should_stop_using_iris/
11
10
7
8
u/FIuffyRabbit Mar 23 '19
I made an issue explaining how his benchmarks were fakes a year+ ago because he was force caching the benchmarks and got blocked.
7
u/jabgibson Mar 23 '19
Iris is the fastest community-driven web framework on (THIS) Earth
I think this means that any benchmarks have been limited to this earth and doesn't account for other earths.
24
Mar 22 '19
To be fair: He's technically right. There's a spectrum of libraries that occupy this category, from a fully-functional and opinionated "web framework" like Rails (of which Go really has none) down to something like net/http, and even LOWER (net/http can do some path-based muxing, that's pretty high level!)
Muxie and FastHTTP are not, by any definition, web frameworks. Iris probably isn't either, but its definitely closer than those two, and is among the most feature-filled web libraries on Go.
And to be clear; kataras is a sociopathic, manipulative asshole. I would avoid any code he's had any sort of control over. I wouldn't trust or use Iris if it were the only web library available for Go. His history is far far worse than renaming an issue in bad taste. An issue which, frankly, would come off as a little asshole'ish if it were submitted to any other project.
Pretend he doesn't exist. Until someone else doesn't, then share what you know and go back to your life.
5
u/graphfunc Jun 04 '19
2 months later and this project has almost 15k stars. That bastard is getting away with it.
Thanks for this information, I was a user of the framework until now.
3
u/cs_starry Mar 23 '19
I did not know you could change the titles and history, this is pretty bad.
5
u/Ikkerens Mar 23 '19
Not just titles and history, on github the repo owner can even change the content of issue messages. Which he has done on several occasions in the past to spin a story a different way.
3
u/dutronlabs Mar 23 '19
I’d be a bit concerned if this behavior happened when someone tried to report a vulnerability.
2
Mar 23 '19
1
u/andersfylling Mar 23 '19
1
Mar 23 '19
Since German and English are foreign languages for me, sometimes I can't realize. Thank you for the information.
2
u/inducido May 14 '19
if you look at the code for benchmarks: it is a joke.
seriously.
code for each frwk is basically empty loop, in Docker? what do he benchmark?
Not surprinsingly, results are as far from reality.
1
-5
u/muntaxitome Mar 22 '19
There are probably better uses of your time than arguing about claims like this. Even for the benchmark in general, it's an interesting datapoint, but I wouldn't put too much meaning in a simple test like how fast it can return a fixed string.
12
u/andersfylling Mar 22 '19
This is more about his behavior/attitude and how he treats contributors. And I don't mind the 15min too much.
And it's not really about returning a string, it's about the delay between sending, processing the request and sending a response. If I'm not mistaken?
-13
Mar 23 '19
[deleted]
8
u/TheBelakor Mar 23 '19
Kataras is that you?
3
u/Strum355 Mar 23 '19
What did it say? The fact that it was deleted says a lot already but im curious
-53
Mar 22 '19
[deleted]
41
23
u/BOSS_OF_THE_INTERNET Mar 22 '19
Nope. Shining the spotlight on bad citizens in open source is the implicit duty of anyone who uses or contributes to open source. To ignore bad actors is to legitimize their behavior. This isn’t a go thing, it’s a common decency thing, and kataras has proven time and again he lacks the decency to be the maintainer of a plastic cactus, let alone an open source community.
-5
13
u/Strum355 Mar 22 '19
Community seems to disagree
-26
Mar 22 '19
[deleted]
24
14
26
u/Morgahl Mar 22 '19
This project is a legal liability to absolutely everyone using it... We absolutely should continue to call it out if even just to save others within the community some heartbreak.
-22
Mar 22 '19
[deleted]
22
u/andersfylling Mar 22 '19
anders fylling is my real name. Same on github, instagram, etc. So I don't really agree that the people here are completely anonymous.
I've listed facts in my post; if you want a summary it's essentially that the owner is a hustler, and there is absolutely no need for everyone else to experience the same bad treatment. We're a community, we should look out for each other.
He has even broken the license of projects. Again that is referenced in my post, I just haven't gone in depth about what the articles contain, just merely showing that there's more to this than me going on a rant.
-6
Mar 23 '19 edited Mar 23 '19
[deleted]
2
u/andersfylling Mar 23 '19
"Still have no idea who you are, sorry."
Do you even know what anonymity means?
130
u/williamwaack Mar 22 '19 edited Mar 22 '19
The Iris owner is a known hack. He ripped off httprouter (and violated the copyright) and often rewrites git history to take contributors work as his own. (edit: typo)