4 ms·

Can someone expain please? Wouldn't the devs just have a local copy? Or I guess their prod builds all crashed trying to install the dependency?

ultrarunner 7y ago
It appears that he deleted a listing from RubyGems, a (the?) package distribution platform for Ruby. Yes they probably have several copies, but now Bundler won't work until they re-host & re-register the gem. Deleting from RubyGems was probably more impactful than removing it from Github. I'm unfamiliar with how Chef works, but I wouldn't be surprised if a `bundle install` was part of the workflow. Maybe someone else with more experience here can fill in some gaps.
salawat 7y ago
Generally speaking, yes. Most government projects locally mirror dependencies (and source) if available, as having to do a few tweaks now and again isn't unheard of. So taking your code down really isn't quite doing much more than virtue signaling. Even less so in fact, as they'd just have someone grab it through whatever alternative distribution method you'd utilize for everyone else and bring it in. You'd have to explicitly revoke license for everyone to do with your library as they please. I.e. become non-open source to effectively restrict access in any meaningful way.
bradknowles 7y ago
I know Seth, and he’s a really good guy. He also used to work at Chef. I signed the Chef Contributors License and their Chef Code of Conduct. I fully support his decision to pull his code. What he has really highlighted here is a major OpSec fail on the part of the company. They should have internal repos containing trusted and verified copies of all code they are dependent on for their build and deployment process. His code is released under an Apache license, so it is totally legit for the company to fork the repo and produce their own private version. But they really stepped in it when they changed the license after forking, removed his name, etc....

ultrarunner 7y ago

It appears that he deleted a listing from RubyGems, a (the?) package distribution platform for Ruby. Yes they probably have several copies, but now Bundler won't work until they re-host & re-register the gem. Deleting from RubyGems was probably more impactful than removing it from Github. I'm unfamiliar with how Chef works, but I wouldn't be surprised if a `bundle install` was part of the workflow. Maybe someone else with more experience here can fill in some gaps.

salawat 7y ago

Generally speaking, yes. Most government projects locally mirror dependencies (and source) if available, as having to do a few tweaks now and again isn't unheard of. So taking your code down really isn't quite doing much more than virtue signaling. Even less so in fact, as they'd just have someone grab it through whatever alternative distribution method you'd utilize for everyone else and bring it in. You'd have to explicitly revoke license for everyone to do with your library as they please. I.e. become non-open source to effectively restrict access in any meaningful way.

bradknowles 7y ago

I know Seth, and he’s a really good guy. He also used to work at Chef. I signed the Chef Contributors License and their Chef Code of Conduct. I fully support his decision to pull his code. What he has really highlighted here is a major OpSec fail on the part of the company. They should have internal repos containing trusted and verified copies of all code they are dependent on for their build and deployment process. His code is released under an Apache license, so it is totally legit for the company to fork the repo and produce their own private version. But they really stepped in it when they changed the license after forking, removed his name, etc....