Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

rubycentral.org

Post reply on HN
Print view View original

91–100 of 102 posts

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#91

Post by axelthegerman »

ibawt wrote: post #59
tra3 wrote: post #52

Earlier quoted context omitted.

Link? I see a reference to them firing 50 people since April. They are still hiring aggressively, I'm talking to one of their recruiters next week.

https://www.theglobeandmail.com/business/article-shopify-com...

Gotta love employees leaking internal information. Not that any software development projects were ever late... Haven't heard about laying off 50 people anywhere else but compared to hiring 2000+ last year it seems not unheard of.

Other companies split their stock too.

I think there's no denial that we're in a different economic situation than we were a year or so ago - it's all about how you deal with it

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#92

Post by notpachet »

LAC-Tech wrote: post #87
mr_ruby_man wrote: post #83

Earlier quoted context omitted.

In this circle, untyped is vernacular for languages that don't do static typing as a default. So yes you are correct, but the OP is also very aware it is dynamically typed.

Is he? No offence but if someone can't get basic terms right, then maybe they should speak with a little less confidence.

Eh, yes I'm aware. You're right, I should have said dynamically typed. I was just thinking faster than I was writing. Kind of an annoying nitpick but I guess it's on brand for HN.

edit: or writing faster than I was thinking? Potato potato.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#93

Post by rglullis »

brianwawok wrote: post #88
rglullis wrote: post #38

Earlier quoted context omitted.

I'm guessing you wouldn't mind sharing receipts of your donations that certainly amount to much more than 0.002% of your net worth?

I’m not submitting a PR stunt on hacker news about it.

If you want to talk crap about a company that gives 0.002% of their "market cap" to FOSS development, at least be ready to show that you are doing better than that. Otherwise, your indignation sounds like nothing but a mere cheap attempt at virtue signalling, and FOSS devs can not use that to pay their bills.

What amazes me is they are giving money with no strings attached, and of course there will be some entitled prick who will try to find fault at that. I wish more companies did "PR stunts" like these...

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#94

Post by pabs3 »

brasic wrote: post #27

This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package m…

This reminds me of the Reproducible Builds project:

https://reproducible-builds.org/

Part of that is that each builder signs statements about what inputs they used and build results they got and then you trust the ones that agree.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#95

Post by dfrey1 »

jacques_chester wrote: post #5
CharlesW wrote: post #4

Earlier quoted context omitted.

How did the conversation about doing this start? Who made the case and sold it internally?

> How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.

Great seeing you (and flavorjones) do big things at Shopify, Jacques! Always great seeing your impact, after our Pivotal/VMware days

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#96

Post by brasic »

pabs3 wrote: post #94
brasic wrote: post #27

This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package m…

This reminds me of the Reproducible Builds project: https://reproducible-builds.org/ Part of that is that each builder signs statements about what inputs they used and build results they got and then you trust the ones that agree.

Definitely! In ruby it’s even easier for most gems where source == build

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#97

Post by jack_riminton »

jacques_chester wrote: post #23
jack_riminton wrote: post #20

Earlier quoted context omitted.

Can you go into which particular aspects of security in Ruby, from Shopify's perspective, needs improving and how?

I can give a limited answer based on my own day-to-day work. I work in Ruby Dependency Security, which is the team who are most involved in helping out with rubygems.org and RubyGems work. Our biggest effort lately has been about rolling out MFA requirements for owners of top-most-downloaded gems. What I'd like to do afterwards is focus on gem signing using sigstore, which would make it a "one click" experience for a…

very helpful thank you

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#98

Post by mulmen »

zdragnar wrote: post #69
mulmen wrote: post #53

Earlier quoted context omitted.

200k for a senior engineer doesn't sound like too much. If anything it sounds like a bargain.

It's a very high salary for the geographic market we're in, and we are far too small a company to compete directly with FAANGs. Even having worked for west coast companies, I've never gotten $200k base salary- adjusted for my region, most pay in the $150-175 range, and I've got quite a few years under my belt.

If you can’t hire I question if it is high for your area. I am sympathetic to your position but the market seems to have spoken.

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#99

Post by jacques_chester »

dfrey1 wrote: post #95
jacques_chester wrote: post #5

Earlier quoted context omitted.

> How did the conversation about doing this start? Who made the case and sold it internally? I made the initial pitch that we should support Ruby Central, but it took off very quickly once senior leadership saw the pitch. Once we got the go-ahead it was mostly worked out by Mike Dalessio (aka flavorjones) and Rafael França for Shopify and Evan Phoenix for Ruby Central.

Great seeing you (and flavorjones) do big things at Shopify, Jacques! Always great seeing your impact, after our Pivotal/VMware days

Thanks!

Re: Ruby Shield: Shopify donates $1M to stewards of rubygems, bundler

#100

Post by lbrito »

notpachet wrote: post #40
thallium205 wrote: post #33

Earlier quoted context omitted.

If it's not the fault of the ecosystem or the language then why is it in decline?

I actually think it's both. The language: Tech companies are becoming more aware of the dangers posed by maintaining and updating large codebases written in an untyped language. I know there's a lot of work still being done in Rubyland on this problem but it feels like the horse left the barn long ago. A lot of Rubyists seem aesthetically opposed to types, including influential language stewards. Sorbet is arguably t…

>The language: Tech companies are becoming more aware of the dangers posed by maintaining and updating large codebases written in an untyped language.

This (insinuation that dynamic typing is inherently worse to maintain) actually isn't true. There's no evidence proving this. Its one of those things that slowly became common sense and goes unquestioned.

There was a Github repo with scientific publications demonstrating the above. I think it made it to HN a while ago. Wish I could find it now.

Post reply on HN