4 ms·
Shopify has plenty of resources to run their own internal, ultra secure Rubygems mirror.
by skywhopper 1y ago
Shopify has plenty of resources to run their own internal, ultra secure Rubygems mirror.
- zrail 1y agoWith no insider knowledge whatsoever I can assure you that they do. Large enterprise shops always have these things cached because why take a hard deploy-time external dependency when you can spin up a rubygems (etc) cache backed entirely by your object storage of choice.
- d4mi3n 1y agoFormer Shopifolk here. As of 2022 - 2023 they had some private packages in their SCM and an internal Artifactory deployment that was a caching proxy of Rubygems and other upstream dependencies. This may be changed since, but as far as I’m aware many Shopify devs occasionally volunteer time and fixes to Rubygems and related projects from time to time. They certainly have the capacity to run their own full on mirror service, but I doubt they have serious incentive to do so given exciting controls and culture re: Ruby and OSS contributions.
- kimos 1y agoThere is no way. Shopify is trying to be part of the Ruby community, because it knows if it becomes the community or bypasses the community, then the community are dead. I think what is most likely is that Shopify is trying to achieve some security goals in rubygems through Ruby Central. That they put a deadline on funding based on some security guarantees. Shopify knows they are a high value target. I bet they thought they could muscle for whatever they want using funding money, and didn’t anticipate the mishandling and then blowback.
- TehCorwiz 1y agoBeing a part of the community necessitates that there be a community to be part of. Taking unilateral control is not being part of a community.