6 ms·

This is the only mitigation that distributions like RubyGems can use to curtail abuse without a major redesign, but it's far from enough. This is the wrong mode

This is the only mitigation that distributions like RubyGems can use to curtail abuse without a major redesign, but it's far from enough. This is the wrong model for software distribution. We would be wise to look to Linux-style distributions as an alternative, where malware is essentially unheard of rather than a weekly occurrence.

jacques_chester 4y ago
If you would like to maintain such a curated resource, please do. But even then you'd need MFA.
- ddevault 4y ago
  There are many, many Linux distributions that are already maintained in this fashion. Most of them provide Ruby packages! And they already have strong cryptographic signatures for all packages -- which is much better than MFA.
  - jacques_chester 4y ago
    Rubygems already has signatures. To a first approximation, nobody bothers. I know you're very gung ho on the idea of curation, but let me be blunt. Nobody is going to do it. Debian has on the order of 97k packages with 990 volunteer members curating them. RubyGems has 180k packages with 3 volunteers. Really it's 2 volunteers. So unless you know of 987 volunteers champing at the bit to review 180k packages from scratch, it's just not going to happen. And let's not even start on PyPI (340k packages) or npm (2 million packages).
    - ddevault 4y ago
      I'll match your bluntness, then: suggesting that anything on the order of 2 million packages are actually useful is plainly ridiculous. Debian et al act as quality filters by only actually packaging the stuff anyone cares about or needs. A stronger argument along these lines lists the packages that you actually need which are missing. And once you have such a list -- add them to Debian! It's not particularly difficult.
      - jacques_chester 4y ago
        If only one in ten npm packages is useful, that's still 2x Debian's current current package count. I just don't think there are enough people available and willing to what you want. I would be happy to be proved wrong.
        ddevault 4y ago
        Far fewer than 1 in 10 npm packages is useful. I don't think you understand what I want. I don't want to see all of the packages in these repositories added to Linux distributions. I want to see the packages that you need added to these distros.
        jacques_chester 4y ago
        > I want to see the packages that you need added to these distros. So if I need a package, and it's not in the curated repo, what do I do? And no, I don't want to maintain the curated version myself. The whole point of using someone else's software was to save time and effort.
        ddevault 4y ago
        You add it. You are responsible for your dependencies. You should already be getting notified of new releases, reading changelogs, etc, and bumping the pkgver in some repository is not arduous on top of that. The labor, split among everyone who does this, is very managable.
        jacques_chester 4y ago
        It won't happen. But please prove me wrong by finding thousands of people aching to curate tens of thousands of packages that are already widely available through well-known central repositories.
      - cortesoft 4y ago
        And because Debian has such strict curation, a lot of software ends up being distributed via other channels, either from alternative deb package repos or not using a deb package at all. If we add a lot of curation, you will end up with a lot of gems being forced out of rubygems. This will make people become used to sourcing gems from alternative locations, and you will lose even the most basic of protection you get from what rubygems is doing. You, or anyone else, is welcome to create their own, curated and vetted, gem repository. It is not technically difficult to source gems from places other than rubygems, so if there was a demand, developers could use your curated service.

jacques_chester 4y ago

If you would like to maintain such a curated resource, please do. But even then you'd need MFA.

ddevault 4y ago
There are many, many Linux distributions that are already maintained in this fashion. Most of them provide Ruby packages! And they already have strong cryptographic signatures for all packages -- which is much better than MFA.
- jacques_chester 4y ago
  Rubygems already has signatures. To a first approximation, nobody bothers. I know you're very gung ho on the idea of curation, but let me be blunt. Nobody is going to do it. Debian has on the order of 97k packages with 990 volunteer members curating them. RubyGems has 180k packages with 3 volunteers. Really it's 2 volunteers. So unless you know of 987 volunteers champing at the bit to review 180k packages from scratch, it's just not going to happen. And let's not even start on PyPI (340k packages) or npm (2 million packages).
  - ddevault 4y ago
    I'll match your bluntness, then: suggesting that anything on the order of 2 million packages are actually useful is plainly ridiculous. Debian et al act as quality filters by only actually packaging the stuff anyone cares about or needs. A stronger argument along these lines lists the packages that you actually need which are missing. And once you have such a list -- add them to Debian! It's not particularly difficult.
    - jacques_chester 4y ago
      If only one in ten npm packages is useful, that's still 2x Debian's current current package count. I just don't think there are enough people available and willing to what you want. I would be happy to be proved wrong.
      - ddevault 4y ago
        Far fewer than 1 in 10 npm packages is useful. I don't think you understand what I want. I don't want to see all of the packages in these repositories added to Linux distributions. I want to see the packages that you need added to these distros.
        jacques_chester 4y ago
        > I want to see the packages that you need added to these distros. So if I need a package, and it's not in the curated repo, what do I do? And no, I don't want to maintain the curated version myself. The whole point of using someone else's software was to save time and effort.
        ddevault 4y ago
        You add it. You are responsible for your dependencies. You should already be getting notified of new releases, reading changelogs, etc, and bumping the pkgver in some repository is not arduous on top of that. The labor, split among everyone who does this, is very managable.
        jacques_chester 4y ago
        It won't happen. But please prove me wrong by finding thousands of people aching to curate tens of thousands of packages that are already widely available through well-known central repositories.
    - cortesoft 4y ago
      And because Debian has such strict curation, a lot of software ends up being distributed via other channels, either from alternative deb package repos or not using a deb package at all. If we add a lot of curation, you will end up with a lot of gems being forced out of rubygems. This will make people become used to sourcing gems from alternative locations, and you will lose even the most basic of protection you get from what rubygems is doing. You, or anyone else, is welcome to create their own, curated and vetted, gem repository. It is not technically difficult to source gems from places other than rubygems, so if there was a demand, developers could use your curated service.