More big companies that use open source should do this or something similar. The dividends to security, developer productivity, etc are probably extremely high, particularly for a company with hundreds or thousands of engineers already. It's such an efficient use of money to give it to the people who already have the expertise to do the work.
Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
21–30 of 102 posts
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#22Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#23I had a small part in this and I'd be happy to answer questions about it.
Can you go into which particular aspects of security in Ruby, from Shopify's perspective, needs improving and how?
I can give a limited answer based on my own day-to-day work. I work in Ruby Dependency Security, which is the team who are most involved in helping out with rubygems.org and RubyGems work. Our biggest effort lately has been about rolling out MFA requirements for owners of top-most-downloaded gems. What I'd like to do afterwards is focus on gem signing using sigstore, which would make it a "one click" experience for authors. We did some work on it earlier this year[0] but chose to focus on MFA as our first big push. We also aim to devote a substantial fraction of our time to chopping wood and carrying water: looking at honeybadger exception reports, etc.
In terms of the long run there's a whole bunch that can be done to continuously harden every aspect of the Ruby supply chain. One thing we've been involved in founding is the OpenSSF Securing Software Repos working group[1], which has meant that RubyGems maintainers are now talking directly with folks from PyPI, npm, Maven Central, Cargo and others. We all face shared threats (eg, dependency confusion, resurrection attacks etc), so getting together to work collectively and share ideas has been super awesome.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#24Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#25To put in perspective, Shopify has a market cap of 41B. This is 0.00002 of that. The average net worth of an American is 122k[0]. So this is like the average American donating $2.44 to a cause. [0] https://www.fool.com/research/average-net-worth-americans
/u/ufuk has already pointed how this comparison is flawed, but even if it were not - now do the same comparison of how much other companies donate to OSS projects.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#26To put in perspective, Shopify has a market cap of 41B. This is 0.00002 of that. The average net worth of an American is 122k[0]. So this is like the average American donating $2.44 to a cause. [0] https://www.fool.com/research/average-net-worth-americans
You do realize that market cap is not real money, right? That's like saying that an average American who earns 30K USD/year over 33 years will earn 1M USD and thus they should be considered a millionaire.
You do realize I compared market cap to networth? And networth is not money?
Most of an individuals networth is likely tied up in their primary residence and highly illiquid.
If you want, you can repeat my math comparing personal income to corporate income. The difference you will find out is not substantial.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#27This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package management.
Another thing I would love to see is the ability to incorporate a signed attestation that a gem was built from a given signed commit. A common dirty trick by supply-chain blackhats is to publish a gem which contains code other than that of the corresponding tag in source control. Given that rubygems has no means to browse package contents other than downloading and extracting the tarballs for manual inspection this means that people typically reference changelog or diff links on source control hosts, despite the fact that those diffs will only be accurate for gems published by good-faith actors following platform norms.
There are a number of ways to fix this and I sure hope one of them gets implemented.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#28To put in perspective, Shopify has a market cap of 41B. This is 0.00002 of that. The average net worth of an American is 122k[0]. So this is like the average American donating $2.44 to a cause. [0] https://www.fool.com/research/average-net-worth-americans
technically true, but does it have the same impact as a donation of $2.44?
Great question.
They have different impacts. That million allows shopify to get features it wants and aligns the project to it's goals. That $2.44 comes without those strings.
You can afford more developers with a million but you end up building something shopify supports which pulls existing resources away from current priorities.
It can boost or even kill a project.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#29Earlier quoted context omitted.
technically true, but does it have the same impact as a donation of $2.44?
Great question. They have different impacts. That million allows shopify to get features it wants and aligns the project to it's goals. That $2.44 comes without those strings. You can afford more developers with a million but you end up building something shopify supports which pulls existing resources away from current priorities. It can boost or even kill a project.
If you read the post you will see this is a donation without strings as well.
Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler
#30I had a small part in this and I'd be happy to answer questions about it.
How did the conversation about doing this start? Who made the case and sold it internally?
(I helped make the case internally at Shopify.) The key points we emphasized are in the Ruby Shield announcement, but to summarize:
- Attacks on supply chains are way up
- Use of open-source software is way up
- Shopify is already contributing engineering time to bundler and rubygems.org
- And there is additional shovel-ready work that Ruby Central could execute on with a financial contribution.
Proactive security work now reduces the chances of a successful supply chain attack and the costs associated with recovery, investigation, and mitigation in addition to reputational damage.
There are secondary benefits, too: when we're confident in the supply chain, we can more confidently update our dependencies in a timely fashion, meaning our developers have access to the newest library features; and we're able to patch known vulnerabilities faster. We invest a lot in feedback loops internally, and this is just another facet of that build/measure/learn cycle.