4 ms·

I hope they tackle the actual main issue with Rubygems -- lack of any sort of code signing... (I know the functionality exists, but it's not required to publish

I hope they tackle the actual main issue with Rubygems -- lack of any sort of code signing... (I know the functionality exists, but it's not required to publish in Rubygems, and off by default on gem install. In other words it's as if it doesn't exist) The fash problem in the Rails ecosystem is next on the list, and I hope there is community consensus to fork this as well.

burnt-resistor 1y ago
It has code signing. It's just optional, inconvenient, and so unused because of Tragedy of the Commons and complacency. https://guides.rubygems.org/security/ https://guides.rubygems.org/security/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-your-rubygem-cert/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-you...
- phoronixrly 1y ago
  As I said, it's as good as no code signing. The very lack of a chain of trust stemming from rubygems that can be used to verify gem authenticity makes the whole thing useless.
simianparrot 1y ago
What does “fash problem” mean?
- phoronixrly 1y ago
  If you know you know.
- ramon156 1y ago
  There's some weird opinions coming from mostly DHH. My personal take is that they're blatantly racist, but everyone can have their own Here's some fun facts: - DHH enforced a "No Politics at Work" policy. - DHH wrote a post expressing that he wouldn't want to live in London anymore because it's "no longer full of native Brits", and expressed support for a Tommy Robinson march he called "heartwarming". Tommy Robinson is described as "an anti-Islam campaigner and one of the UK's most prominent far-right activists.". The march DHH praised featured speakers calling for ethnic cleansing via "remigration" and banning all non-Christian religions. - DHH also promoted "demographic replacement" conspiracy theories and used language connecting immigration to crime, particularly regarding "Pakistani rape gangs" and street theft. - DHH has been publicly critical of Diversity, Equity, and Inclusion initiatives. This one isn't backed by facts, so take it with a grain of salt.
  - ishouldbework 1y ago
    Cannot speak for the US, but in Europe immigration is connected to crime increase in general. The Ukraine refugees are one of few statistical exceptions.
    - mijoharas 1y ago
      Have you got any references for this claim?
      - ishouldbework 1y ago
        Well, https://link.springer.com/article/10.1007/s10611-024-10144-y https://link.springer.com/article/10.1007/s10611-024-10144-y seems to claim there is a link for sexual crimes. This paper suggests that there is some delayed effect https://www.sciencedirect.com/science/article/pii/S0927537123001410 https://www.sciencedirect.com/science/article/pii/S092753712....
    - busterarm 1y ago
      I think a lot of people are forgetting or at least choose to ignore that DHH is Danish (and specifically a Danish expat) and is probably more inclined to have controversial views on immigration from majority Islamic countries. That's not to give his statements a pass, but to give them some needed context. And no, I'm not saying that Danes are racist.
      - bsammon 1y ago
        I think a lot of people don't know why being Danish is relevant. Is there some reason why controversial views on immigration might be less suprising coming from a Dane?
        drak0n1c 1y ago
        Denmark is the rare case of a European nation where its center-left listened to feedback from the electorate early on and earnestly adopted policies restricting immigration and refugee admission. As a result they had no populist backlash, and that policy position is uncontroversial to hold publicly.
- deleted 1y ago
  [deleted]
- marknutter 1y ago
  That's the part where the term "fascist" is misused to smear somebody they disagree with. It can be safely ignored.
  - simianparrot 1y ago
    I thought so but didn’t want to assume. People really like to misuse terms like fascism these days, huh…
    - typpilol 1y ago
      It's so crazy. He's a fascist because he said something about the chant population of London. And he didn't want politics at the work place How the hell is any of that facism
      - marknutter 1y ago
        It's not. People use the term "fascism" to at best smear those who they disagree with and at worst incite violence against them.
      - shadowgovt 1y ago
        Fascism may be the wrong label. Racism could be a much better fit. The blog post in question: https://world.hey.com/dhh/as-i-remember-london-e7d38e64 https://world.hey.com/dhh/as-i-remember-london-e7d38e64 The interpretation that raises some pretty interesting points about the inherent racism in the expressed worldview: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/ https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... There is, however, an interpretation that explains how this specific kind of racism can be seen as at least fascism-adjacent: https://davidcel.is/articles/rails-needs-new-governance https://davidcel.is/articles/rails-needs-new-governance The question of whether he wants politics in the workplace is moot when he's making public blog posts like this. For the open-source community, the open Internet is the workplace. People aren't just going to pretend DHH didn't say what he said (in public, of his own free will, using his own megaphone) because he didn't post it to ruby-core@ml.ruby-lang.org.

burnt-resistor 1y ago

It has code signing. It's just optional, inconvenient, and so unused because of Tragedy of the Commons and complacency. https://guides.rubygems.org/security/ https://guides.rubygems.org/security/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-your-rubygem-cert/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-you...

phoronixrly 1y ago
As I said, it's as good as no code signing. The very lack of a chain of trust stemming from rubygems that can be used to verify gem authenticity makes the whole thing useless.

simianparrot 1y ago

What does “fash problem” mean?

phoronixrly 1y ago
If you know you know.
ramon156 1y ago
There's some weird opinions coming from mostly DHH. My personal take is that they're blatantly racist, but everyone can have their own Here's some fun facts: - DHH enforced a "No Politics at Work" policy. - DHH wrote a post expressing that he wouldn't want to live in London anymore because it's "no longer full of native Brits", and expressed support for a Tommy Robinson march he called "heartwarming". Tommy Robinson is described as "an anti-Islam campaigner and one of the UK's most prominent far-right activists.". The march DHH praised featured speakers calling for ethnic cleansing via "remigration" and banning all non-Christian religions. - DHH also promoted "demographic replacement" conspiracy theories and used language connecting immigration to crime, particularly regarding "Pakistani rape gangs" and street theft. - DHH has been publicly critical of Diversity, Equity, and Inclusion initiatives. This one isn't backed by facts, so take it with a grain of salt.
- ishouldbework 1y ago
  Cannot speak for the US, but in Europe immigration is connected to crime increase in general. The Ukraine refugees are one of few statistical exceptions.
  - mijoharas 1y ago
    Have you got any references for this claim?
    - ishouldbework 1y ago
      Well, https://link.springer.com/article/10.1007/s10611-024-10144-y https://link.springer.com/article/10.1007/s10611-024-10144-y seems to claim there is a link for sexual crimes. This paper suggests that there is some delayed effect https://www.sciencedirect.com/science/article/pii/S0927537123001410 https://www.sciencedirect.com/science/article/pii/S092753712....
  - busterarm 1y ago
    I think a lot of people are forgetting or at least choose to ignore that DHH is Danish (and specifically a Danish expat) and is probably more inclined to have controversial views on immigration from majority Islamic countries. That's not to give his statements a pass, but to give them some needed context. And no, I'm not saying that Danes are racist.
    - bsammon 1y ago
      I think a lot of people don't know why being Danish is relevant. Is there some reason why controversial views on immigration might be less suprising coming from a Dane?
      - drak0n1c 1y ago
        Denmark is the rare case of a European nation where its center-left listened to feedback from the electorate early on and earnestly adopted policies restricting immigration and refugee admission. As a result they had no populist backlash, and that policy position is uncontroversial to hold publicly.
deleted 1y ago
[deleted]
marknutter 1y ago
That's the part where the term "fascist" is misused to smear somebody they disagree with. It can be safely ignored.
- simianparrot 1y ago
  I thought so but didn’t want to assume. People really like to misuse terms like fascism these days, huh…
  - typpilol 1y ago
    It's so crazy. He's a fascist because he said something about the chant population of London. And he didn't want politics at the work place How the hell is any of that facism
    - marknutter 1y ago
      It's not. People use the term "fascism" to at best smear those who they disagree with and at worst incite violence against them.
    - shadowgovt 1y ago
      Fascism may be the wrong label. Racism could be a much better fit. The blog post in question: https://world.hey.com/dhh/as-i-remember-london-e7d38e64 https://world.hey.com/dhh/as-i-remember-london-e7d38e64 The interpretation that raises some pretty interesting points about the inherent racism in the expressed worldview: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/ https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... There is, however, an interpretation that explains how this specific kind of racism can be seen as at least fascism-adjacent: https://davidcel.is/articles/rails-needs-new-governance https://davidcel.is/articles/rails-needs-new-governance The question of whether he wants politics in the workplace is moot when he's making public blog posts like this. For the open-source community, the open Internet is the workplace. People aren't just going to pretend DHH didn't say what he said (in public, of his own free will, using his own megaphone) because he didn't post it to ruby-core@ml.ruby-lang.org.