3 ms·

So we have DHH with his unhinged posts on one side, and Arko wanting to sell PII on the other. Great! I think we need an f-droid-like project for Rubygems that

So we have DHH with his unhinged posts on one side, and Arko wanting to sell PII on the other. Great! I think we need an f-droid-like project for Rubygems that builds the gems from source, and takes care of signing, and is backed by a non-profit that is independent from Rails/Shopify

dismalaf 1y ago
Gem can pull in gems from any repository, even straight from a git server like GitHub. And most of the time gems are built from scratch on your computer, Nokogiri is the only one I can think of that isn't.
- zrail 1y ago
  The problem, as with every package manager, is transitive dependencies. It's all well and good to set up direct dependencies to only pull from git repositories, but bundler still needs a way to resolve those gems' dependencies. You could pre-resolve every dependency in your chain to a git repository, even to a fork under your own control, but that will end up being a maintenance nightmare.
  - Imustaskforhelp 1y ago
    Can't a middle compromise happen as it happens in something like golang? Can some vps/serverless provider not do this like fly.io as an recent example with kurt got got? or hetzner? I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/outside funding/drama overall
    - zrail 1y ago
      Retrofitting Go's dependency model into Ruby is not trivial. Go has used full URLs for dependencies from the jump, making a central package repository irrelevant. Ruby doesn't have that. At best you might have a source code URL in the gem source that you can access from a gem server, but that doesn't really anything. Someone still has to provide the index.
    - phoronixrly 1y ago
      > I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/outside funding/drama overall It also means no code signing and the natural capture of most of the ecosystem by Microsoft (due to devs preferring to host their code on github, a bundler that lacks package hosting will be entirely at the whim of MS)
      - Imustaskforhelp 1y ago
        If you are worried about github/MS capture... Then my suggestion is to just create mirrors of golang projects you like on gitlab/codeberg But this is so so much better than having arko or somebody having your PII. Like I hate github but I am pretty sure that people there aren't actively looking for my PII when I download go projects or that a single person couldn't really access it I suppose I am not really familiar but if I remember the heads project related to coreboot isn't there a way to sign your github repository with your ssh key or something related (I can be wrong, I usually am) Like I know it could be a pain in the ass but if you are so worried about github, what if we could optionally have everything be gpg'd via ssh keys & the project could only work if someone shares a ssh key And something like rubygems could just have a name <-> github mapping <-> gpg mapping and it might require some additional software right now but I am just giving ideas maybe for new languages as well I am not sure What are your thoughts? And what do you think the ideal way could be. I have heard from many people (like primagen) that golang is the best package model and I also resonate with that statement but yeah github is a bit of menace/threat to open source All the more reason to use something like codeberg!
Imustaskforhelp 1y ago
Yes! Not even sure why you are being downvoted, this is such a great idea actually. F-droid has been so professional and they are just so professional There was this developer (axet) who recently accused f-droid of somehow convincing the users "maliciously" that the funds are going to the the creator and f-droid when in reality it was going to f-droid and he name called them and what not.. Do you know what f-droid team still said? They said that they can help him in the donation process and remove theirs and they actually took some feedback from what I know... They clarified that the donations in their about page that the money that you donate through f-droid in their website's homepage donate goes to f-droid only which should be obvious but for some it wasn't they also had f-droid donate in the website links of apps and I am not sure when they stopped it but they also stopped it and I deeply deeply respect it. Like, okay maybe mistakes happen but f-droid is seriously good corporation. We might need something like that for sure. I genuinely think that out of thinking about open source so much, I realized that we need to have priorities to share things about open source. F-droid is on the top of the list, its just that great, then there is signal/grapheneos or maybe all 3 are on top... F-droid as an organization is something that I deeply appreciate and its a shame of google's attestation. I genuinely love f-droid nowadays.
- phoronixrly 1y ago
  > Not even sure why you are being downvoted, this is such a great idea actually. Expressing negative opinions about DHH is not well-received here. Oddly enough the Ruby community includes both the most thoughtful and gentle people and the biggest assholes I know... I refuse to believe the latter are not fringe.
  - Imustaskforhelp 1y ago
    Yes I absolutely hate DHH as well and in fact I was using omarchy but then migrated over to cachyos hyprland https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/ https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... DHH is not a good guy but the hype around him made me feel so. He's weird and racist and fascist. Stop the hype around dhh and everyone please read the article everybody here's DHH reality Let’s ditch the superlatives and review David’s post objectively: He thinks that even if you were born in the UK, you only count as British if you’re white. He wouldn’t consider living in London specifically because it has too many people of color. He uses racist tropes to accuse Asian men of being dangerous predators who attack white women. He pushes debunked conspiracy theories about immigrants replacing white people. He finds a march where speakers called for banning all non-Christian religions and ethnically cleansing immigrants “heartwarming”. Finally — and maybe most alarmingly — he argues that all of the above is normal and not extreme. You can use whatever word you want to describe all that. But if you, like me, didn’t realize that this is who DHH is, we can probably agree that he’s way worse than we thought. The above lines were from the article This guy shouldn't remotely be talked about in a good light imo, yes I appreciate open source but I can't seperate the art from the artist. I genuinely don't know why they defend this guy. HN literally flaged this post in literal minutes when it had come out but I was lucky to have read it and I will continue to spread this word because HN's moderators seem to flag anything like this and its kinda sick and enabling behaviour really They will allow the post that cf is sponsoring omarchy promotion thing or omarchy links in general but not a dhh-is-way-worse-than-i-thought/and I was surprised by how quickly they deleted the post that after I had read that post, it got flagged and I couldn't even write a comment. A little bit Shocking if I can be honest. I was on omarchy but now I am on cachyos hyprland and I learnt some custom live iso stuff too, I might make an article about it... I edited this because maybe I got a little angry towards DHH but I genuinely don't like the guy. I genuinely admired him as a person untill I found about it and I have strong opinions on him. I think its the paradox of tolerance, should we as a society be tolerant to the intolerant people?

dismalaf 1y ago

Gem can pull in gems from any repository, even straight from a git server like GitHub. And most of the time gems are built from scratch on your computer, Nokogiri is the only one I can think of that isn't.

zrail 1y ago
The problem, as with every package manager, is transitive dependencies. It's all well and good to set up direct dependencies to only pull from git repositories, but bundler still needs a way to resolve those gems' dependencies. You could pre-resolve every dependency in your chain to a git repository, even to a fork under your own control, but that will end up being a maintenance nightmare.
- Imustaskforhelp 1y ago
  Can't a middle compromise happen as it happens in something like golang? Can some vps/serverless provider not do this like fly.io as an recent example with kurt got got? or hetzner? I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/outside funding/drama overall
  - zrail 1y ago
    Retrofitting Go's dependency model into Ruby is not trivial. Go has used full URLs for dependencies from the jump, making a central package repository irrelevant. Ruby doesn't have that. At best you might have a source code URL in the gem source that you can access from a gem server, but that doesn't really anything. Someone still has to provide the index.
  - phoronixrly 1y ago
    > I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/outside funding/drama overall It also means no code signing and the natural capture of most of the ecosystem by Microsoft (due to devs preferring to host their code on github, a bundler that lacks package hosting will be entirely at the whim of MS)
    - Imustaskforhelp 1y ago
      If you are worried about github/MS capture... Then my suggestion is to just create mirrors of golang projects you like on gitlab/codeberg But this is so so much better than having arko or somebody having your PII. Like I hate github but I am pretty sure that people there aren't actively looking for my PII when I download go projects or that a single person couldn't really access it I suppose I am not really familiar but if I remember the heads project related to coreboot isn't there a way to sign your github repository with your ssh key or something related (I can be wrong, I usually am) Like I know it could be a pain in the ass but if you are so worried about github, what if we could optionally have everything be gpg'd via ssh keys & the project could only work if someone shares a ssh key And something like rubygems could just have a name <-> github mapping <-> gpg mapping and it might require some additional software right now but I am just giving ideas maybe for new languages as well I am not sure What are your thoughts? And what do you think the ideal way could be. I have heard from many people (like primagen) that golang is the best package model and I also resonate with that statement but yeah github is a bit of menace/threat to open source All the more reason to use something like codeberg!

Imustaskforhelp 1y ago

Yes! Not even sure why you are being downvoted, this is such a great idea actually. F-droid has been so professional and they are just so professional There was this developer (axet) who recently accused f-droid of somehow convincing the users "maliciously" that the funds are going to the the creator and f-droid when in reality it was going to f-droid and he name called them and what not.. Do you know what f-droid team still said? They said that they can help him in the donation process and remove theirs and they actually took some feedback from what I know... They clarified that the donations in their about page that the money that you donate through f-droid in their website's homepage donate goes to f-droid only which should be obvious but for some it wasn't they also had f-droid donate in the website links of apps and I am not sure when they stopped it but they also stopped it and I deeply deeply respect it. Like, okay maybe mistakes happen but f-droid is seriously good corporation. We might need something like that for sure. I genuinely think that out of thinking about open source so much, I realized that we need to have priorities to share things about open source. F-droid is on the top of the list, its just that great, then there is signal/grapheneos or maybe all 3 are on top... F-droid as an organization is something that I deeply appreciate and its a shame of google's attestation. I genuinely love f-droid nowadays.

phoronixrly 1y ago
> Not even sure why you are being downvoted, this is such a great idea actually. Expressing negative opinions about DHH is not well-received here. Oddly enough the Ruby community includes both the most thoughtful and gentle people and the biggest assholes I know... I refuse to believe the latter are not fringe.
- Imustaskforhelp 1y ago
  Yes I absolutely hate DHH as well and in fact I was using omarchy but then migrated over to cachyos hyprland https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thought/ https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... DHH is not a good guy but the hype around him made me feel so. He's weird and racist and fascist. Stop the hype around dhh and everyone please read the article everybody here's DHH reality Let’s ditch the superlatives and review David’s post objectively: He thinks that even if you were born in the UK, you only count as British if you’re white. He wouldn’t consider living in London specifically because it has too many people of color. He uses racist tropes to accuse Asian men of being dangerous predators who attack white women. He pushes debunked conspiracy theories about immigrants replacing white people. He finds a march where speakers called for banning all non-Christian religions and ethnically cleansing immigrants “heartwarming”. Finally — and maybe most alarmingly — he argues that all of the above is normal and not extreme. You can use whatever word you want to describe all that. But if you, like me, didn’t realize that this is who DHH is, we can probably agree that he’s way worse than we thought. The above lines were from the article This guy shouldn't remotely be talked about in a good light imo, yes I appreciate open source but I can't seperate the art from the artist. I genuinely don't know why they defend this guy. HN literally flaged this post in literal minutes when it had come out but I was lucky to have read it and I will continue to spread this word because HN's moderators seem to flag anything like this and its kinda sick and enabling behaviour really They will allow the post that cf is sponsoring omarchy promotion thing or omarchy links in general but not a dhh-is-way-worse-than-i-thought/and I was surprised by how quickly they deleted the post that after I had read that post, it got flagged and I couldn't even write a comment. A little bit Shocking if I can be honest. I was on omarchy but now I am on cachyos hyprland and I learnt some custom live iso stuff too, I might make an article about it... I edited this because maybe I got a little angry towards DHH but I genuinely don't like the guy. I genuinely admired him as a person untill I found about it and I have strong opinions on him. I think its the paradox of tolerance, should we as a society be tolerant to the intolerant people?