5 ms·
How RubyGems.org protects OSS infrastructure
- IFC_LLC 1y agoInteresting how the Internet turned into a place where you have to search for a long time in order to find something valuable. In this case - you have a dedicated team that sits there and diligently works on the quality of their product. I should have turned to RoR 3 years ago.
- infamouscow 1y agoWelcome to the ecosystem o/
- ecshafer 1y agoRuby on Rails is the most productive web framework I have ever worked in. RoR + the Ecosystem is really geared towards getting things working quickly asap and its great.
- willgabriel 1y ago[dead]
- IFC_LLC 1y agoOh, I will. I will. I'm quite amazed by the dedication of the team that supports the framework and how good of a care they have been taking about it. Funny enough, one of my first articles I've ever written on the internet was about RoR. It's dated 1st of March 2010. Gosh, It's been 15 years. At that moment I used https://rubyforge.org https://rubyforge.org to download RoR, Instant Rails for Windows and Aptana as an IDE. 15 years have gone by, but RoR is here just like PHP is. So it's getting better and better.
- jrochkind1 1y agoPlease note though that the team supporting rubygems is not the team that supports the Rails framework. These are different projects.
- cosmic_cheese 1y agoGood work to everybody involved. Looking into donating now. Ruby/Rails and its ecosystem continues to prove itself the practical, boring, reliable workhorse option.
- princevegeta89 1y agoBoring? Not really. My 2c: it is more enjoyable than the Js/Ts ecosystem we have today.
- woodruffw 1y agoI think they meant boring in a positive way, as in "choose boring technology."
- wredcoll 1y agoGod, this gave me flashbacks to people saying the same thing, except with perl.
- f4stjack 1y agoAgreed. Time and time again, I wished I'd knew Ruby and/or RoR. Do you know any good (and "boring" as in time-tested & practical) tutorials/learning resources?
- janfoeh 1y ago"Programming Ruby" [0] ("the pickaxe book") and "Agile Web Development with Rails" [1], both from Pragmatic Programmers. I learned Ruby and Rails through them in the late 2000's; they are still being released as new editions. It has been a while since I bought new books from PragProg, but they used to have a recurring sale of ~40% off around late autumn (thanksgiving?). [0] https://pragprog.com/titles/ruby5/programming-ruby-3-3-5th-edition/ https://pragprog.com/titles/ruby5/programming-ruby-3-3-5th-e... [1] https://pragprog.com/titles/rails8/agile-web-development-with-rails-8/ https://pragprog.com/titles/rails8/agile-web-development-wit...
- 1y ago
- burnt-resistor 1y agoBut still lacks mandatory gem signing. I also wonder how many malicious gems were published prior to this.
- firesteelrain 1y agoEven if it was mandatory, if it doesn’t get signed by a trusted CA then it is still self signed. RubyGems would have to reject all. But signing alone does not prevent malicious code
- mdaniel 1y agoAIUI, the threat model isn't "self signed versus not," I would suspect the modern threat model is "current release signed by the same cert as prior release". The Android ecosystem is backed by this threat model, and (zip parsing nonsense aside) seems to be doing well with it. Even F-Droid, which runs their own signing stack, participates although it is not compatible with the Play Store distribution mechanism due to "who owns the signing key"
- notpushkin 1y agoIt’s compatible if reproducible builds are used: https://fdroid.gitlab.io/jekyll-fdroid/docs/Reproducible_Builds/ https://fdroid.gitlab.io/jekyll-fdroid/docs/Reproducible_Bui...
- mdaniel 1y agoThat's interesting, thanks for drawing my attention to it. I would need to go spelunking around to see how they reference an .apk from the Play Store, which I got the impression used crazypants gRPC shenanigans for building download URLs --- I went sniffing around and while I didn't go through all tens of pages, it sure does seem like that's only used for non-Play Store style verification, and thus my assertion seems to stand https://gitlab.com/search?group_id=28397&project_id=36528&search=binaries&search_code=true https://gitlab.com/search?group_id=28397&project_id=36528&se...
- decasia 1y agoAbout this, I noticed a relatively prominent gem maintainer publicly announcing his efforts to avoid rubygems security measures: > I'll try to get a unicorn 7.x release soon but tests take forever to run on ancient HW and I need to ration releases to keep download counts low in order to stay under the MFA threshold on Rubygems.org > I don't ever want users viewing me as trustworthy nor liable for anything I do, so no MFA nor sigs from me; just source + docs :> If I understand correctly - the idea is that the unicorn maintainer does not want to be viewed as trustworthy and is avoiding MFA and signatures because they could build trust that isn't, in this case, wanted. https://yhbt.net/unicorn-public/20231214230933.M299458@dcvr/ https://yhbt.net/unicorn-public/20231214230933.M299458@dcvr/
- Lammy 1y ago[flagged]
- paulryanrogers 1y agoSo the solution is none? Not better MFA tools?
- mcny 1y agoI hate Microsoft's approach which puts its own MFA app as somehow better than standard TOTP. I want to use standard apps like authy or aegis or even apple passwords app which doesn't require my phone to be connected to the Internet. I sincerely do not agree with their premise at all. Coming back to OP, better MFA tools and allowing people to NOT display the verified checkmark should solve the issue? At least talk to the person and hear their grievances.
- halostatue 1y agoAs noted, the maintainer is eccentric. They will not do anything that requires JavaScript.
- drzaiusx11 1y ago
- Dan42 1y agoReading this, I couldn't help but think these guys really know where their towel is. The opposite of enshittification?
- cortesoft 1y agoIsn't this because there isn't a for profit company running this? They don't have to enshittify to make money for investors.