5 ms·

I had a small part in this and I'd be happy to answer questions about it.

by jacques_chester 4y ago

CharlesW 4y ago
How did the conversation about doing this start? Who made the case and sold it internally?
- jacques_chester 4y ago
  > How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.
  - Tabular-Iceberg 4y ago
    How do investors feel about this? Being a dev myself and knowing how the sausage is made and how FOSS is the casing that holds it all together, this investment makes perfect sense. But I can also see how investment types would complain, it doesn't exactly look like an investment in the books.
    - deleted 4y ago
      [deleted]
    - deleted 4y ago
      [deleted]
    - vlunkr 4y ago
      Hopefully by this point investors know that Shopify both relies on and contributes to lots of FOSS.
    - mstipetic 4y ago
      Shopify has more than 5 billion usd in revenue. I don’t think investors care much
    - jeromegv 4y ago
      Shopify is built with Ruby. The whole tech stack depends on it. Paying for that software is one way or another is a normal business expense.
      - Tabular-Iceberg 4y ago
        >Paying for that software is one way or another is a normal business expense. It should be, but conventional bookkeeping hasn't really kept up with the economic realities of this industry. Same reason why they fail to account tech debt as a liability, refactoring as amortization and debugging as interest payments.
    - canucklady 4y ago
      Shopify is the Canadian meme stock. When I worked there everyone I met knew about them, not because of the product, but because the news loved to talk about Canada's one domestic tech success in the last 10 years. During the pandemic they briefly became Canada's most valuable company, and then lost all their gains for the past 2 years, then did a stock split because it was trendy with retail investors. They have a ton of terrific engineers but the nouveau riche people from the IPO are largely insufferable, and the amount of reverence for tobi inside and outside of the company is just unhinged.
    - jrockway 4y ago
      This amount of money is well within what you'd expect to pay for various proprietary software packages. You can probably add up all unused-but-not-deleted VMs, S3 buckets, and their payroll/vacation tracking software and you're at 1 million dollars. I've started responding to "hey, do you want to talk to sales?" messages with "sure", just to see what stuff costs in the real world. Everything is 5 or 6 figures, even static website hosting. I wouldn't pay $20,000 a month to host a static website, but someone must be, because that's what people are asking for on these calls. I can see a world where you say yes to even a few of these vendors, and the cost of securing the entire Ruby ecosystem looks like a rounding error in comparison. At the end of the day, I doubt the investors care. If they want to cut costs, there are much better ways.
  - dfrey1 4y ago
    Great seeing you (and flavorjones) do big things at Shopify, Jacques! Always great seeing your impact, after our Pivotal/VMware days
    - jacques_chester 4y ago
      Thanks!
- flavorjones 4y ago
  (I helped make the case internally at Shopify.) The key points we emphasized are in the Ruby Shield announcement, but to summarize: - Attacks on supply chains are way up - Use of open-source software is way up - Shopify is already contributing engineering time to bundler and rubygems.org - And there is additional shovel-ready work that Ruby Central could execute on with a financial contribution. Proactive security work now reduces the chances of a successful supply chain attack and the costs associated with recovery, investigation, and mitigation in addition to reputational damage. There are secondary benefits, too: when we're confident in the supply chain, we can more confidently update our dependencies in a timely fashion, meaning our developers have access to the newest library features; and we're able to patch known vulnerabilities faster. We invest a lot in feedback loops internally, and this is just another facet of that build/measure/learn cycle.
jack_riminton 4y ago
Can you go into which particular aspects of security in Ruby, from Shopify's perspective, needs improving and how?
- jacques_chester 4y ago
  I can give a limited answer based on my own day-to-day work. I work in Ruby Dependency Security, which is the team who are most involved in helping out with rubygems.org and RubyGems work. Our biggest effort lately has been about rolling out MFA requirements for owners of top-most-downloaded gems. What I'd like to do afterwards is focus on gem signing using sigstore, which would make it a "one click" experience for authors. We did some work on it earlier this year[0] but chose to focus on MFA as our first big push. We also aim to devote a substantial fraction of our time to chopping wood and carrying water: looking at honeybadger exception reports, etc. In terms of the long run there's a whole bunch that can be done to continuously harden every aspect of the Ruby supply chain. One thing we've been involved in founding is the OpenSSF Securing Software Repos working group[1], which has meant that RubyGems maintainers are now talking directly with folks from PyPI, npm, Maven Central, Cargo and others. We all face shared threats (eg, dependency confusion, resurrection attacks etc), so getting together to work collectively and share ideas has been super awesome. [0] https://github.com/rubygems/rfcs/pull/37 https://github.com/rubygems/rfcs/pull/37 [1] https://github.com/ossf/wg-securing-software-repos https://github.com/ossf/wg-securing-software-repos
  - jack_riminton 4y ago
    very helpful thank you

I had a small part in this and I'd be happy to answer questions about it.

CharlesW 4y ago

How did the conversation about doing this start? Who made the case and sold it internally?

jacques_chester 4y ago
> How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.
- Tabular-Iceberg 4y ago
  How do investors feel about this? Being a dev myself and knowing how the sausage is made and how FOSS is the casing that holds it all together, this investment makes perfect sense. But I can also see how investment types would complain, it doesn't exactly look like an investment in the books.
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - vlunkr 4y ago
    Hopefully by this point investors know that Shopify both relies on and contributes to lots of FOSS.
  - mstipetic 4y ago
    Shopify has more than 5 billion usd in revenue. I don’t think investors care much
  - jeromegv 4y ago
    Shopify is built with Ruby. The whole tech stack depends on it. Paying for that software is one way or another is a normal business expense.
    - Tabular-Iceberg 4y ago
      >Paying for that software is one way or another is a normal business expense. It should be, but conventional bookkeeping hasn't really kept up with the economic realities of this industry. Same reason why they fail to account tech debt as a liability, refactoring as amortization and debugging as interest payments.
  - canucklady 4y ago
    Shopify is the Canadian meme stock. When I worked there everyone I met knew about them, not because of the product, but because the news loved to talk about Canada's one domestic tech success in the last 10 years. During the pandemic they briefly became Canada's most valuable company, and then lost all their gains for the past 2 years, then did a stock split because it was trendy with retail investors. They have a ton of terrific engineers but the nouveau riche people from the IPO are largely insufferable, and the amount of reverence for tobi inside and outside of the company is just unhinged.
  - jrockway 4y ago
    This amount of money is well within what you'd expect to pay for various proprietary software packages. You can probably add up all unused-but-not-deleted VMs, S3 buckets, and their payroll/vacation tracking software and you're at 1 million dollars. I've started responding to "hey, do you want to talk to sales?" messages with "sure", just to see what stuff costs in the real world. Everything is 5 or 6 figures, even static website hosting. I wouldn't pay $20,000 a month to host a static website, but someone must be, because that's what people are asking for on these calls. I can see a world where you say yes to even a few of these vendors, and the cost of securing the entire Ruby ecosystem looks like a rounding error in comparison. At the end of the day, I doubt the investors care. If they want to cut costs, there are much better ways.
- dfrey1 4y ago
  Great seeing you (and flavorjones) do big things at Shopify, Jacques! Always great seeing your impact, after our Pivotal/VMware days
  - jacques_chester 4y ago
    Thanks!
flavorjones 4y ago
(I helped make the case internally at Shopify.) The key points we emphasized are in the Ruby Shield announcement, but to summarize: - Attacks on supply chains are way up - Use of open-source software is way up - Shopify is already contributing engineering time to bundler and rubygems.org - And there is additional shovel-ready work that Ruby Central could execute on with a financial contribution. Proactive security work now reduces the chances of a successful supply chain attack and the costs associated with recovery, investigation, and mitigation in addition to reputational damage. There are secondary benefits, too: when we're confident in the supply chain, we can more confidently update our dependencies in a timely fashion, meaning our developers have access to the newest library features; and we're able to patch known vulnerabilities faster. We invest a lot in feedback loops internally, and this is just another facet of that build/measure/learn cycle.

jack_riminton 4y ago

Can you go into which particular aspects of security in Ruby, from Shopify's perspective, needs improving and how?

jacques_chester 4y ago
I can give a limited answer based on my own day-to-day work. I work in Ruby Dependency Security, which is the team who are most involved in helping out with rubygems.org and RubyGems work. Our biggest effort lately has been about rolling out MFA requirements for owners of top-most-downloaded gems. What I'd like to do afterwards is focus on gem signing using sigstore, which would make it a "one click" experience for authors. We did some work on it earlier this year[0] but chose to focus on MFA as our first big push. We also aim to devote a substantial fraction of our time to chopping wood and carrying water: looking at honeybadger exception reports, etc. In terms of the long run there's a whole bunch that can be done to continuously harden every aspect of the Ruby supply chain. One thing we've been involved in founding is the OpenSSF Securing Software Repos working group[1], which has meant that RubyGems maintainers are now talking directly with folks from PyPI, npm, Maven Central, Cargo and others. We all face shared threats (eg, dependency confusion, resurrection attacks etc), so getting together to work collectively and share ideas has been super awesome. [0] https://github.com/rubygems/rfcs/pull/37 https://github.com/rubygems/rfcs/pull/37 [1] https://github.com/ossf/wg-securing-software-repos https://github.com/ossf/wg-securing-software-repos
- jack_riminton 4y ago
  very helpful thank you