Happy 20th Birthday, Django

Does/did Django have a reputation for instability or insecurity?

Also, how on Earth did the ML PhDs decide physically segregated databases for each user were a requirement?

It has neither reputation, and to my knowledge, has never had serious incidents of either. It powers huge websites like pokemon.com

And if you spend any time working with a group of PhDs, you'll be shocked at some of the harebrained schemes they come up with. Dumb people are dumb in simple ways. Smart people are dumb in genius ways.

It's not that Django has/had any reputation for those things -- it's that Django had no reputation at all since it was a nascent project with no track record. That means it had no proof points for being stable or secure. At the time I adopted it (~Nov 2005), the public release of the Django project was only a few months old, and indeed breaking changes followed soon after (the so-called "magic removal branch"). As I recall, there were also various template escaping security issues at that time.

> Also, how on Earth did the ML PhDs decide physically segregated databases for each user were a requirement?

I worked at several labs at top academic institutions, on everything from supercomputer MPI work for multi-agent sims to image pipelines for large weather simulations, and one thing I learned is that being a good coder is orthogonal to being a good researcher. In that particular case, the person who wrote the code made the assumption that the "customers" would not allow their sensor data to be stored alongside the data from other customers, and separate databases with separate passwords was the solution they came up with. Somehow they did not notice that the terrible ergonomics of this solution meant there was probably a better way. Once I ripped out MySQL in favor of Postgres (since it had proper security) and removed the cumbersome middleware layer performance improved by over 100x.

how does one get to be a coder in a research project

As a student, ask around or check with your advisor. Most labs will have positions for students interested in coding "grunt work" because students are cheap.

As a professional, apply to Masters/PhD programs in your area of interest, or be young and an expert in an obscure technology the lab uses. Some labs will hire out contract work, but can't pay well (hence be young). Other labs have grant money to bring in non-phd researchers, but to get the job you'll both have to be an expert in a required technology, and be able to contribute actively to the research area of the lab. At Yale, I did this, as second author on a conference paper showing novel methods for applying machine learning in multi-agent, sensor -driven environments. It justified my paycheck as a researcher while I spent the other half of my time fixing broken code for other researchers and writing the first version of the software for our lab spinout.

Edit: I just want to clarify that my experiences with this don't go past 2010, so YMMV. Getting old is tough sometimes, it still feels like almost yesterday.

> to my knowledge, has never had serious incidents of either.

The magic removal branch in 2006 was one such case (of API instability). I recall another case circa 2007(?) with a "new admin". But, importantly, pre-1.0 Django made no guarantees of API stability. Post-1.0 Django has had a pretty rock-solid reputation for stability and security.