9 ms·
Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
- coderinsg 4y agoKudos to Shopify! that's exemplary of what I think businesses that leveraged on Open-source should mimic. It's a gesture of gratitude and being appreciative. In addition, it keeps the lights on and motivates the community.
- xutopia 4y agoShopify is such a good citizen.
- jacques_chester 4y agoWe work hard to be. We posted an accompanying blog post about how we see our place in OSS: https://shopify.engineering/shopify-open-source-philosophy https://shopify.engineering/shopify-open-source-philosophy
- belfalas 4y agoNice! I especially like “it improves engineering skills” - if an organizations engineers are never doing anything new their skills stagnate.
- ayewo 4y agoYour HN handle been a pretty vocal ambassador of Pivotal/VMware Tanzu on a lot of threads that the employee-employer association has become permanent in my lizard brain, which is why I had to do a double-take when I read your comment [plus the fact that I'm up a bit late ...] It only just dawned on me that you might have switched your employer allegiance to Shopify :)
- jacques_chester 4y agoI was vocally at Pivotal->VMware for a total of 7 years, so a reasonable enough association to form. I've been at Shopify for a little over a year now.
- ayewo 4y agoI see. Belated congrats on the new gig!
- jacques_chester 4y agoThanks!
- dominotw 4y agohelps that ceo understands what these things are and why they are useful.
- elevenoh 4y ago
- Tabular-Iceberg 4y agoJudging from the little I can see in spite of the paywall, it doesn't seem like Shopify did anything particularly nefarious for Trudeau. Unless there's more to the story I don't think it's fair to assign guilt by association because someone else did nefarious things in Trudeau's name.
- deleted 4y ago[deleted]
- charlesbarbier 4y agoTrudeau government tyranny? Give me a break
- elevenoh 4y ago
- jacques_chester 4y agoI had a small part in this and I'd be happy to answer questions about it.
- CharlesW 4y agoHow did the conversation about doing this start? Who made the case and sold it internally?
- jacques_chester 4y ago> How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.
- Tabular-Iceberg 4y agoHow do investors feel about this? Being a dev myself and knowing how the sausage is made and how FOSS is the casing that holds it all together, this investment makes perfect sense. But I can also see how investment types would complain, it doesn't exactly look like an investment in the books.
- johnasmith 4y agoShopify CEO Tobias Lutke was a core Rails developer. He's tightly connected to the Ruby & Rails communities.
- brianwawok 4y agoTo put in perspective, Shopify has a market cap of 41B. This is 0.00002 of that. The average net worth of an American is 122k[0]. So this is like the average American donating $2.44 to a cause. [0] https://www.fool.com/research/average-net-worth-americans https://www.fool.com/research/average-net-worth-americans
- asciiresort 4y ago> So this is like the average American donating $2.44 to a cause. You’re making this sound like a bad thing. It’s a kind gesture nonetheless.
- kyleee 4y agotechnically true, but does it have the same impact as a donation of $2.44?
- ipaddr 4y agoGreat question. They have different impacts. That million allows shopify to get features it wants and aligns the project to it's goals. That $2.44 comes without those strings. You can afford more developers with a million but you end up building something shopify supports which pulls existing resources away from current priorities. It can boost or even kill a project.
- rafaelfranca 4y agoIf you read the post you will see this is a donation without strings as well.
- ipaddr 4y agoI'm not sure the post cover this. The intent is without strings but the truth is it buys a bigger voice and platform. Did you hear about the $2.44 I gave? No you didn't.. there was no press release or hn article.
- jmcgough 4y agoMore big companies that use open source should do this or something similar. The dividends to security, developer productivity, etc are probably extremely high, particularly for a company with hundreds or thousands of engineers already. It's such an efficient use of money to give it to the people who already have the expertise to do the work.
- farleykr 4y agoDo you think that would cause things to veer back toward a paid model or do you see a third way between straight up FOSS and paid software?
- newtwilly 4y agoDonating money to projects that you use heavily doesn't sound like any kind of traditional paid model to me.
- jacques_chester 4y agoIt seems like my peers at other such companies are being modest, so I will speak up on their behalf. Microsoft and Google have jointly funded the OpenSSF Alpha-Omega project to the tune of $5M. In turn Alpha-Omega has granted $300k for Node.js security[0] and $400k each to the Python Software Foundation and the Eclipse Foundation for security work[1]. Google are also forming an "Open Source Maintenance Crew"[2], a group of engineers dedicated solely to helping OSS projects improve security. Meanwhile Google, Microsoft, VMware, Intel, Ericsson and Amazon have contributed $30M ($10M from Amazon alone![5]) to the OpenSSF[3] towards a $150M plan to address OSS ecosystem security more broadly[4]. This will begin to bear substantial fruit over the next few years. For Shopify, Ruby Central is close to our history and our heart; it makes both logical and moral sense for us to give back generously. But that by no means diminishes that many companies are starting to step up in a big way across the board. It is an exciting and promising time for open source security. [0] https://openssf.org/blog/2022/04/18/openssf-selects-node-js-as-initial-project-to-improve-supply-chain-security/ https://openssf.org/blog/2022/04/18/openssf-selects-node-js-... [1] https://openssf.org/blog/2022/06/20/openssf-funds-python-and-eclipse-foundations-and-acquires-sos-dev-through-alpha-omega-project/ https://openssf.org/blog/2022/06/20/openssf-funds-python-and... [2] https://blog.google/technology/safety-security/shared-success-in-building-a-safer-open-source-community/ https://blog.google/technology/safety-security/shared-succes... [3] https://openssf.org/press-release/2022/05/12/the-linux-foundation-and-open-source-software-security-foundation-openssf-gather-industry-and-government-leaders-for-open-source-software-security-summit-ii/ https://openssf.org/press-release/2022/05/12/the-linux-found... [4] https://openssf.org/oss-security-mobilization-plan/ https://openssf.org/oss-security-mobilization-plan/ [5] https://aws.amazon.com/blogs/opensource/aws-investing-an-additional-10-million-in-open-source-supply-chain-security/ https://aws.amazon.com/blogs/opensource/aws-investing-an-add...
- brasic 4y agoThis is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package management. Another thing I would love to see is the ability to incorporate a signed attestation that a gem was built from a given signed commit. A common dirty trick by supply-chain blackhats is to publish a gem which contains code other than that of the corresponding tag in source control. Given that rubygems has no means to browse package contents other than downloading and extracting the tarballs for manual inspection this means that people typically reference changelog or diff links on source control hosts, despite the fact that those diffs will only be accurate for gems published by good-faith actors following platform norms. There are a number of ways to fix this and I sure hope one of them gets implemented.
- ironick09 4y agoYou should send your suggestions to Ruby Central.
- jacques_chester 4y agobrasic is also welcome to participate in the OpenSSF Securing Software Repos working group, where we collectively discuss these kinds of efforts across multiple ecosystems. The best place to get started is the OpenSSF "Get Involved" page: https://openssf.org/getinvolved/ https://openssf.org/getinvolved/
- brasic 4y agoThanks!
- pabs3 4y agoThis reminds me of the Reproducible Builds project: https://reproducible-builds.org/ https://reproducible-builds.org/ Part of that is that each builder signs statements about what inputs they used and build results they got and then you trust the ones that agree.
- ezekiel11 4y agoyet ruby on rails and ruby is in decline. its getting harder to hire younger developers in this field, many don't even know what Ruby is or cares for it. Seems like its another PHP type of situation, one which companies will move away from in the coming years. Not the fault of the ecosystem or language but simply because it gets expensive and the talent pool shrinks, not a good driver for business decision makers to back. edit: i really dont understand the downvotes here I am simply mentioning the changing requirements in many companies that used to be on RoR that cannot find enough senior developers with the budget they are used to, to the point that they are moving to a new platform. theres just not enough RoR jobs and not enough RoR senior devs in the marketplace today and it will be far more bleak in the near future. there's not a lot of new minds coming into RoR and thats the talent pool you are gonna be stuck with if you keep the trajectory. Ask any new graduate and what tech stack language they are using, I'm willing to bet it isn't Ruby or RoR. Their attention is in Javascript or Python or more niche languages like Rust/Elixir/Clojure
- thallium205 4y agoIf it's not the fault of the ecosystem or the language then why is it in decline?
- ezekiel11 4y agoattention is in decline. developers are paying more attention to other languages that yields greater number of employment options. it should be that RoR devs get increasing rates as they become rarer but its not, demand is also dwindling as enterprises feel uneasy about banking the future on a smaller talent pool.
- mediaman 4y agoWhy is Rails in decline? I see a lot of people say they're developing instead with rust, or python, or javascript. But Rust has little to do with what Ruby/Rails is used for, and Python is mostly used in other fields also (it's not like Django is taking over the world). Every time I look at the various JS frameworks it seems like just a huge lift to get something going versus Rails, for typical SME type business problems. Most problems don't really seem to require SPA. Things like Elixir/Phoenix look very interesting and promising, but their ecosystem is (for now) much smaller. And just the size of the Elixir community right now suggests that it's not like all the RoR developers went to Elixir. So what is the thing that is so much more attractive than Rails, to solve your everyday business logic issues for small to medium scale problems? Does all engineers and companies think they are solving Google-scale problems or something? I feel like I'm missing something obvious.
- sandGorgon 4y agogoogle should do the same for pypy and other python related projects. going all the way to tensorflow, google ought to have a lot of interest in the ecosystem to mature. but event the top story today - https://news.ycombinator.com/item?id=32002057 https://news.ycombinator.com/item?id=32002057 - were primarily Microsoft engineers
- cosmiccatnap 4y agoThey have also laid off a bunch of their employees today...
- tra3 4y agoLink? I see a reference to them firing 50 people since April. They are still hiring aggressively, I'm talking to one of their recruiters next week.
- cosmiccatnap 4y agoI bet you that you won't. Hope I'm wrong. They just split their stock and it's continuing to tank. Had a friend get his interview canceled today because they removed the position, said it was for financial reasons.
- ibawt 4y agohttps://www.theglobeandmail.com/business/article-shopify-compensation-hiring-plans/ https://www.theglobeandmail.com/business/article-shopify-com...
- axelthegerman 4y agoGotta love employees leaking internal information. Not that any software development projects were ever late... Haven't heard about laying off 50 people anywhere else but compared to hiring 2000+ last year it seems not unheard of. Other companies split their stock too. I think there's no denial that we're in a different economic situation than we were a year or so ago - it's all about how you deal with it
- asciiresort 4y agoTherefore they should not sponsor this project from which the company derived value?