3 ms·

I don't plan on switching to a rubygems fork that does not offer technical/security benefits over the original. They can win me over with a gem distribution si

I don't plan on switching to a rubygems fork that does not offer technical/security benefits over the original. They can win me over with a gem distribution site that requires code signing out of the box and a bundler that enforces it out of the box.

mijoharas 1y ago
For me, having the software be maintained (and have a security engineer working on it) feels like a security benefit. Does the original have many maintainers left?
- phoronixrly 1y ago
  It has allegedly been taken over by Shopify. I expect it to be very well maintained. The issues are of ethical character.
  - mperham 1y ago
    Well maintained? Rubygems has had no commits in the last 10 days and that's not a good sign. I don't think you can find a window with no commits for 10 days in its 15+ year history. History has shown over and over that when a for-profit org takes over public infrastructure, maintenance is cut to the bone.
    - gkbrk 1y ago
      > Rubygems has had no commits in the last 10 days and that's not a good sign. I honestly can't tell if this is satire. You think no commits for 10 days for a piece of software that has existed for around 20 years is a sign that it's dead? What kind of code churn do you think this project requires? Perhaps the old development was too unstable if there wasn't a single 10 day window without a commit in 15 years, for what is essentially a solved problem and a tool that people depend on to be stable.
      - RhythmFox 1y ago
        Churn is not just rate of commits it is the changing of the same lines/files/functions repeatedly, AI answers seem to get this wrong a few places I checked which is interesting. Rate of change in itself is not 'instability', it can be a sign of new ideas emerging or lot of other positive things. Package management cannot be a 'solved problem' or there would be no innovation there, and you don't have to look far to find is not the case. As for the idea that rubygems is 'dead' (not what mperham said), that is still too early to say for sure, as I imagine mperham would also agree, but it is definitely not a good sign. If we only get a trickle of changes to something that was once a very vibrant and lively community repo then that is to the detriment of the whole Ruby ecosystem. That would also be a bad sign.
      - mijoharas 1y ago
        Rubygems has 216 open issues right now.[0] Do you think some of them should be addressed? Without maintenance, and any PR's getting merged, they won't. [0] https://github.com/rubygems/rubygems/issues https://github.com/rubygems/rubygems/issues
joeldrapper 1y ago
I expect a lot of people will stop pushing gem updates to `rubygems.org` once `gem.coop` supports publishing directly to namespaces.
- joeldrapper 1y ago
  Yes, I will be one of those people.
soraminazuki 1y ago
Which part of a project that kicked out its original maintainers still feels "original" to you? At this point, rubygems.org is the fork. Oh, how times have changed. If Oracle were to close source OpenSolaris today, many here would likely rally behind it, especially if Larry Ellison appeared to align with the right. Submissions about Illumos would have been heavily flagged, much like this one has been for a while.
- jaredcwhite 1y ago
  Excellent point, I can't help but feel gem.coop is essentially Ruby Together 2.0 which reinforces my opinion that the merger of RT with RC was a huge mistake. (It certainly made sense at the time…hindsight is always 20/20…etc.…but still.)
sussmannbaka 1y ago
They had a minor security incident right off the bat, demonstrating they don’t even fully understand what they stole. They aren’t equipped to do the job.
- typpilol 1y ago
  I missed that. What happened?
  - sussmannbaka 1y ago
    https://joel.drapper.me/p/ruby-central-security-measures/ https://joel.drapper.me/p/ruby-central-security-measures/
    - GreenWatermelon 1y ago
      Completely missed that. This is just the cherry on top if this shit cake. André is a better man than I. I wouldn't be able to resist making threats about turning off prod.
- joeldrapper 1y ago
  Only “minor” because they were in fact wrong about André being a risk. Had he been a real risk, this would have been about as major as it gets. They left him with root production AWS console and full production database access. Fortunately he’s a standup guy and not a real security risk, so he emailed them immediately to let them know.

mijoharas 1y ago

For me, having the software be maintained (and have a security engineer working on it) feels like a security benefit. Does the original have many maintainers left?

phoronixrly 1y ago
It has allegedly been taken over by Shopify. I expect it to be very well maintained. The issues are of ethical character.
- mperham 1y ago
  Well maintained? Rubygems has had no commits in the last 10 days and that's not a good sign. I don't think you can find a window with no commits for 10 days in its 15+ year history. History has shown over and over that when a for-profit org takes over public infrastructure, maintenance is cut to the bone.
  - gkbrk 1y ago
    > Rubygems has had no commits in the last 10 days and that's not a good sign. I honestly can't tell if this is satire. You think no commits for 10 days for a piece of software that has existed for around 20 years is a sign that it's dead? What kind of code churn do you think this project requires? Perhaps the old development was too unstable if there wasn't a single 10 day window without a commit in 15 years, for what is essentially a solved problem and a tool that people depend on to be stable.
    - RhythmFox 1y ago
      Churn is not just rate of commits it is the changing of the same lines/files/functions repeatedly, AI answers seem to get this wrong a few places I checked which is interesting. Rate of change in itself is not 'instability', it can be a sign of new ideas emerging or lot of other positive things. Package management cannot be a 'solved problem' or there would be no innovation there, and you don't have to look far to find is not the case. As for the idea that rubygems is 'dead' (not what mperham said), that is still too early to say for sure, as I imagine mperham would also agree, but it is definitely not a good sign. If we only get a trickle of changes to something that was once a very vibrant and lively community repo then that is to the detriment of the whole Ruby ecosystem. That would also be a bad sign.
    - mijoharas 1y ago
      Rubygems has 216 open issues right now.[0] Do you think some of them should be addressed? Without maintenance, and any PR's getting merged, they won't. [0] https://github.com/rubygems/rubygems/issues https://github.com/rubygems/rubygems/issues

joeldrapper 1y ago

I expect a lot of people will stop pushing gem updates to `rubygems.org` once `gem.coop` supports publishing directly to namespaces.

joeldrapper 1y ago
Yes, I will be one of those people.

soraminazuki 1y ago

Which part of a project that kicked out its original maintainers still feels "original" to you? At this point, rubygems.org is the fork. Oh, how times have changed. If Oracle were to close source OpenSolaris today, many here would likely rally behind it, especially if Larry Ellison appeared to align with the right. Submissions about Illumos would have been heavily flagged, much like this one has been for a while.

jaredcwhite 1y ago
Excellent point, I can't help but feel gem.coop is essentially Ruby Together 2.0 which reinforces my opinion that the merger of RT with RC was a huge mistake. (It certainly made sense at the time…hindsight is always 20/20…etc.…but still.)

sussmannbaka 1y ago

They had a minor security incident right off the bat, demonstrating they don’t even fully understand what they stole. They aren’t equipped to do the job.

typpilol 1y ago
I missed that. What happened?
- sussmannbaka 1y ago
  https://joel.drapper.me/p/ruby-central-security-measures/ https://joel.drapper.me/p/ruby-central-security-measures/
  - GreenWatermelon 1y ago
    Completely missed that. This is just the cherry on top if this shit cake. André is a better man than I. I wouldn't be able to resist making threats about turning off prod.
joeldrapper 1y ago
Only “minor” because they were in fact wrong about André being a risk. Had he been a real risk, this would have been about as major as it gets. They left him with root production AWS console and full production database access. Fortunately he’s a standup guy and not a real security risk, so he emailed them immediately to let them know.