Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

61–70 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#62

Post by delfinom »

voxic11 wrote: post #44
__float wrote: post #38

Earlier quoted context omitted.

What languages do you use that have adopted this well? I'm not counting something like C++ where there's effectively no "packages" to speak of.

Go has decentralized package hosting and it works reasonably well. Deno does also but I'm less clear on well how that is working out for them.

>Go has decentralized package hosting and it works reasonably well.

All go package imports are proxied via Google.

https://drewdevault.com/2022/05/25/Google-has-been-DDoSing-s...

Re: Ruby core team takes ownership of RubyGems and Bundler

#64

Post by monooso »

voxic11 wrote: post #44
__float wrote: post #38

Earlier quoted context omitted.

What languages do you use that have adopted this well? I'm not counting something like C++ where there's effectively no "packages" to speak of.

Go has decentralized package hosting and it works reasonably well. Deno does also but I'm less clear on well how that is working out for them.

The Deno people recently released jsr.io, "a modern package registry for JavaScript and TypeScript."

I'm not familiar with the technical details, but at first glance it appears pretty centralised.

Re: Ruby core team takes ownership of RubyGems and Bundler

#65

Post by shadowgovt »

Was there ever a mirror of this dustup in the Linux distro community?

I'm unaware of one ever happening, and I'm wondering whether it's because of mere fortune or because there's something about the APT / dpkg model that precludes this kind of messiness.

Perhaps the Ruby community is suffering the curse of having lived with reliable Internet for so long they never had to solve the problem of building up automatic package mirrors? This just feels like a lot of words and energy burned on a problem that ought to be as simple as "Here's the package, here's its checksum, go to town."

Re: Ruby core team takes ownership of RubyGems and Bundler

#67

Post by shadowgovt »

elliotec wrote: post #6

This is a fascinating and seemingly unusual development that will look obvious in history. I find “BDFLs” and open source communities so incredibly interesting. Especially in the context of geopolitics and state entities. Linux! This stuff is PHD material for sociology and polisci post-grads and I’m so interested in following the progression of history with these types of things.

I think you're absolutely right. We are starting to reach the age where a combination of large cooperative non-corporate tech projects and the Internet (that, partially at least, enabled them) are putting us in a place where the actual mortality of project owners matters. The "L" in BDFL is a finite constraint.

I think there's going to be an interesting and complicated churn as several major projects under the BDFL model have their Ds succeed at passing the torch, struggle to pass the torch, struggle to realize the torch needs to be passed, or take the torch and do their best to burn the whole project down so it can't outlive them.

Re: Ruby core team takes ownership of RubyGems and Bundler

#68

Post by bmacho »

baggy_trough wrote: post #47
bmacho wrote: post #37

Earlier quoted context omitted.

The software is open source, not the project. The name is not for the taking. You can download the code, modify and release it, but you can't just claim ownership over a product.

Andre Arko was not the original author, so how did he get the name? Did he take it from someone?

I don't know, and I don't care. I wonder if you try to imply something ridiculously strong, general, and obviously false here?

Re: Ruby core team takes ownership of RubyGems and Bundler

#69

Post by ivan_gammel »

binary132 wrote: post #16

Decentralized package hosting is the only way.

The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become significant or there are several, but not many hostings which everyone can trust. If Number of hostings << Number of users, then it's not truly decentralized and there still exists a different risk, when there's some sort of political split between some of them. Summarizing all of that, I don't know if decentralization is a solution at all. Transparent community ownership over a centralized solution is much better.
Post reply on HN