Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

171–180 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#171

Post by kayodelycaon »

shevy-java wrote: post #96
joshmn wrote: post #46

This is the only outcome that anyone who touches ruby cannot be upset with.

How so? I think there are a gazillion questions left. But, I also agree that the future will tell, e. g. we'll have to see how popular gem.coop will become (if they become popular). And I also, despite my disagreements, think that it may have been better to solve installations of ruby projects from the get go, e. g. Rust + cargo. But I also see this as separate from a service such as rubygems.org (or whoever provides…

It's pretty easy to change the sources for ruby gems using "gem sources" or ~/.gemrc. I'm not sure how that could be improved.

Re: Ruby core team takes ownership of RubyGems and Bundler

#172

Post by basisword »

runjake wrote: post #147
overfeed wrote: post #138

Earlier quoted context omitted.

I'm sure it's a total coincidence that Shopify (on whose board DHH sits) coincidentally became an active participant on toppling the maintainers soon after they criticized DHH. Given the power dynamics, the burden of proof is on Shopify to proove it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.

What you believe and what you can document are two separate things. Per the concept of "innocent until proven guilty", there is no burden on Shopify to prove they didn't do what you believe. The burden is on you to provide evidence for the motivations behind their actions. I personally doubt Tobi got Shopify to where it was by making rash decisions based on emotions and drama.

Hacker News isn’t a court. Nobody has to provide evidence for any opinion they share.

Re: Ruby core team takes ownership of RubyGems and Bundler

#173

Post by andrewmutz »

overfeed wrote: post #138
runjake wrote: post #122

Earlier quoted context omitted.

It's news to me that the RubyCentral event had anything to do with DHH at least directly. You are alleging that Shopify was retaliating. Do you have any reliable context that Shopify was acting in a retaliatory manner?

I'm sure it's a total coincidence that Shopify (on whose board DHH sits) coincidentally became an active participant on toppling the maintainers soon after they criticized DHH. Given the power dynamics, the burden of proof is on Shopify to proove it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.

> Given the power dynamics, the burden of proof is on Shopify to prooave it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.

That’s just a way of saying “I don’t have any evidence of what I’m claiming”

Re: Ruby core team takes ownership of RubyGems and Bundler

#174

Post by zrail »

cortesoft wrote: post #140
zrail wrote: post #45

Earlier quoted context omitted.

Go, for some values of "distributed". The vast majority of go packages are hosted on GitHub, but nothing stops anyone from hosting elsewhere and Go has explicit support for indirection such that anyone can use a vanity domain that happens to point at GitHub or wherever.

Isn't this the same as ruby gems, then? You can use alternative sources in your Gemfile pretty easily.

Sort of.

Go packages have the source baked into the package name. It would be like needing to say `require "github.com/sparklemotion/nokogiri"` rather than what we do today, `require "nokogiri"` and then if you want to change the source wrapping `gem "nokogiri"` in an alternate `source` block.

Re: Ruby core team takes ownership of RubyGems and Bundler

#175

Post by basisword »

brightball wrote: post #83
itsnowandnever wrote: post #31

this is good and I hope this puts a lot of the drama in the rearview mirror. younger developers coming across Ruby must be like "wtf" about this situation. very peculiar to have these projects so politicised and I say that to the people that "try and keep politics out" (DHH) more than anyone. making your politics known and then being like "but you're not allowed to have an opinion on it" is't cute or clever. it's chi…

He's also in a bit of a unique situation because of his public political profile was essentially forced. - Politics at work were becoming a huge problem at 37Signals - They asked that politics be kept out of company chats, but encouraged people to be political active on non-work channels/social media/etc even during work hours - People lost their minds at this incredibly reasonable request which then blew up on the i…

I disagree. DHH said no politics at work. I thought that was great. A sensible moderate position at a time where people were getting polarised.

Then he started a blog, built on his companies software, where he constantly shares extreme political opinions. When you are the public face of a company (and framework) and you are publishing your political opinions using your companies platform, you are now bringing politics to work. He’s a hypocrite.

Re: Ruby core team takes ownership of RubyGems and Bundler

#176

Post by fifticon »

majkinetor wrote: post #166
ameliaquining wrote: post #161

Earlier quoted context omitted.

Unclear, but I think it might have been something like, find out (via reverse IP lookups) which big companies depend on which gems, and then use that information to market consulting services to those companies.

I guess something sinister is also an option...

well,yes, already that description is sinister; I might be getting too old.

Re: Ruby core team takes ownership of RubyGems and Bundler

#178

Post by runjake »

basisword wrote: post #172
runjake wrote: post #147

Earlier quoted context omitted.

What you believe and what you can document are two separate things. Per the concept of "innocent until proven guilty", there is no burden on Shopify to prove they didn't do what you believe. The burden is on you to provide evidence for the motivations behind their actions. I personally doubt Tobi got Shopify to where it was by making rash decisions based on emotions and drama.

Hacker News isn’t a court. Nobody has to provide evidence for any opinion they share.

They should provide evidence when they are leveling accusations against others.

That's how a reasonable society works.

Re: Ruby core team takes ownership of RubyGems and Bundler

#179

Post by tehryanx »

ameliaquining wrote: post #148
cyrnel wrote: post #133

Earlier quoted context omitted.

The response to that: https://andre.arko.net/2025/10/09/the-rubygems-security-inci...

This is about a different part of the controversy, and doesn't respond to the allegation of a monetization proposal.

Yes it does. He's refuting that in this part of the post:

> When they finally did reply, they seem to have developed some sort of theory that I was interested in “access to PII”, which is entirely false. I have no interest in any PII, commercially or otherwise. As my private email published by Ruby Central demonstrates, my entire proposal was based solely on company-level information, with no information about individuals included in any way. Here’s their response, over three days later.

Post reply on HN