Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

rubycentral.org

Post reply on HN
Print view View original

61–70 of 102 posts

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#61

Post by jrockway »

Tabular-Iceberg wrote: post #11
jacques_chester wrote: post #5

Earlier quoted context omitted.

> How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.

How do investors feel about this? Being a dev myself and knowing how the sausage is made and how FOSS is the casing that holds it all together, this investment makes perfect sense. But I can also see how investment types would complain, it doesn't exactly look like an investment in the books.

This amount of money is well within what you'd expect to pay for various proprietary software packages. You can probably add up all unused-but-not-deleted VMs, S3 buckets, and their payroll/vacation tracking software and you're at 1 million dollars.

I've started responding to "hey, do you want to talk to sales?" messages with "sure", just to see what stuff costs in the real world. Everything is 5 or 6 figures, even static website hosting. I wouldn't pay $20,000 a month to host a static website, but someone must be, because that's what people are asking for on these calls. I can see a world where you say yes to even a few of these vendors, and the cost of securing the entire Ruby ecosystem looks like a rounding error in comparison.

At the end of the day, I doubt the investors care. If they want to cut costs, there are much better ways.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#62

Post by ironick09 »

brasic wrote: post #27

This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package m…

You should send your suggestions to Ruby Central.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#63

Post by JohnBooty »

zdragnar wrote: post #43
notpachet wrote: post #40

Earlier quoted context omitted.

I actually think it's both. The language: Tech companies are becoming more aware of the dangers posed by maintaining and updating large codebases written in an untyped language. I know there's a lot of work still being done in Rubyland on this problem but it feels like the horse left the barn long ago. A lot of Rubyists seem aesthetically opposed to types, including influential language stewards. Sorbet is arguably t…

To wit, a personal anecdote: My tiny company is torn between throwing out our ruby code and trying to hire more ruby developers. Our senior ruby guy is leaving, and the one senior candidate we had accepted, then later rejected, our offer. Of the other interviews we have had, candidates were asking for too much (i.e. over $200k base salary) and often barely qualified as a senior, or were simply too inexperienced to re…

Yeah, it's been hard to find Ruby/Rails devs for... as long as I can remember. 2015 at least. Not sure if it's become harder.

What about hiring experienced devs and simply giving them an intro Ruby + Rails course? (which could be as simple as say, giving them 2-3 weeks to go through some self-directed learning)

I think companies often do this badly: they hire non-Ruby devs and expect them to learn by osmosis, which usually results devs simply writing a bunch of bad code - for example, Rails code that fights against core Rails assumptions and looks like Java/PHP/etc.

However, I also think it's pretty easy to get it right. If the company and developer have a good attitude about getting the dev immersed in Ruby/Rails a bit before turning them loose on the main codebase. I'm implementing a curriculum like that now in my current role.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#64

Post by Tabular-Iceberg »

jeromegv wrote: post #48
Tabular-Iceberg wrote: post #11

Earlier quoted context omitted.

How do investors feel about this? Being a dev myself and knowing how the sausage is made and how FOSS is the casing that holds it all together, this investment makes perfect sense. But I can also see how investment types would complain, it doesn't exactly look like an investment in the books.

Shopify is built with Ruby. The whole tech stack depends on it. Paying for that software is one way or another is a normal business expense.

>Paying for that software is one way or another is a normal business expense.

It should be, but conventional bookkeeping hasn't really kept up with the economic realities of this industry. Same reason why they fail to account tech debt as a liability, refactoring as amortization and debugging as interest payments.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#65

Post by jacques_chester »

jmcgough wrote: post #21

More big companies that use open source should do this or something similar. The dividends to security, developer productivity, etc are probably extremely high, particularly for a company with hundreds or thousands of engineers already. It's such an efficient use of money to give it to the people who already have the expertise to do the work.

It seems like my peers at other such companies are being modest, so I will speak up on their behalf.

Microsoft and Google have jointly funded the OpenSSF Alpha-Omega project to the tune of $5M. In turn Alpha-Omega has granted $300k for Node.js security[0] and $400k each to the Python Software Foundation and the Eclipse Foundation for security work[1]. Google are also forming an "Open Source Maintenance Crew"[2], a group of engineers dedicated solely to helping OSS projects improve security. Meanwhile Google, Microsoft, VMware, Intel, Ericsson and Amazon have contributed $30M ($10M from Amazon alone![5]) to the OpenSSF[3] towards a $150M plan to address OSS ecosystem security more broadly[4]. This will begin to bear substantial fruit over the next few years.

For Shopify, Ruby Central is close to our history and our heart; it makes both logical and moral sense for us to give back generously. But that by no means diminishes that many companies are starting to step up in a big way across the board. It is an exciting and promising time for open source security.

[0] https://openssf.org/blog/2022/04/18/openssf-selects-node-js-...

[1] https://openssf.org/blog/2022/06/20/openssf-funds-python-and...

[2] https://blog.google/technology/safety-security/shared-succes...

[3] https://openssf.org/press-release/2022/05/12/the-linux-found...

[4] https://openssf.org/oss-security-mobilization-plan/

[5] https://aws.amazon.com/blogs/opensource/aws-investing-an-add...

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#66

Post by ayewo »

JohnBooty wrote: post #63
zdragnar wrote: post #43

Earlier quoted context omitted.

To wit, a personal anecdote: My tiny company is torn between throwing out our ruby code and trying to hire more ruby developers. Our senior ruby guy is leaving, and the one senior candidate we had accepted, then later rejected, our offer. Of the other interviews we have had, candidates were asking for too much (i.e. over $200k base salary) and often barely qualified as a senior, or were simply too inexperienced to re…

Yeah, it's been hard to find Ruby/Rails devs for... as long as I can remember. 2015 at least. Not sure if it's become harder. What about hiring experienced devs and simply giving them an intro Ruby + Rails course? (which could be as simple as say, giving them 2-3 weeks to go through some self-directed learning) I think companies often do this badly: they hire non-Ruby devs and expect them to learn by osmosis, which u…

> I'm implementing a curriculum like that now in my current role.

Will you be making this public or internal it will remain?

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#67

Post by jacques_chester »

ironick09 wrote: post #62
brasic wrote: post #27

This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package m…

You should send your suggestions to Ruby Central.

brasic is also welcome to participate in the OpenSSF Securing Software Repos working group, where we collectively discuss these kinds of efforts across multiple ecosystems. The best place to get started is the OpenSSF "Get Involved" page: https://openssf.org/getinvolved/

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#68

Post by brasic »

jacques_chester wrote: post #67
ironick09 wrote: post #62

Earlier quoted context omitted.

You should send your suggestions to Ruby Central.

brasic is also welcome to participate in the OpenSSF Securing Software Repos working group, where we collectively discuss these kinds of efforts across multiple ecosystems. The best place to get started is the OpenSSF "Get Involved" page: https://openssf.org/getinvolved/

Thanks!

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#69

Post by zdragnar »

mulmen wrote: post #53
zdragnar wrote: post #43

Earlier quoted context omitted.

To wit, a personal anecdote: My tiny company is torn between throwing out our ruby code and trying to hire more ruby developers. Our senior ruby guy is leaving, and the one senior candidate we had accepted, then later rejected, our offer. Of the other interviews we have had, candidates were asking for too much (i.e. over $200k base salary) and often barely qualified as a senior, or were simply too inexperienced to re…

200k for a senior engineer doesn't sound like too much. If anything it sounds like a bargain.

It's a very high salary for the geographic market we're in, and we are far too small a company to compete directly with FAANGs.

Even having worked for west coast companies, I've never gotten $200k base salary- adjusted for my region, most pay in the $150-175 range, and I've got quite a few years under my belt.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#70

Post by zdragnar »

notpachet wrote: post #45
zdragnar wrote: post #43

Earlier quoted context omitted.

To wit, a personal anecdote: My tiny company is torn between throwing out our ruby code and trying to hire more ruby developers. Our senior ruby guy is leaving, and the one senior candidate we had accepted, then later rejected, our offer. Of the other interviews we have had, candidates were asking for too much (i.e. over $200k base salary) and often barely qualified as a senior, or were simply too inexperienced to re…

Would it be possible to wall off the legacy Ruby code behind a stable interface and switch to writing new features in a different language? Then instead of hulkmania you could perhaps whittle away at the legacy stuff incrementally.

That would require having competing ORMs (rails plus whatever library or ad-hoc we roll in the new code) working against the same database.

Unfortunately, it's a pretty complex system, and the changes we have slated don't really leave room for updating one endpoint at a time. Even if it were simpler, I don't recall anyone ever contemplating having two ORMs running against the same database without a shudder of horror.

Post reply on HN