Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

181–190 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#181

Post by lelanthran »

ivan_gammel wrote: post #69
binary132 wrote: post #16

Decentralized package hosting is the only way.

The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become si…

> The key question here is how exactly the supply chain attacks will be prevented

By using signed packages. Why is this even a question.

Re: Ruby core team takes ownership of RubyGems and Bundler

#182

Post by mindcrash »

shadowgovt wrote: post #57
neya wrote: post #35

Earlier quoted context omitted.

Any summary of what exaclty unfolded please (if you don't mind)? Sorry haven't been following the Ruby news for sometime.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

If only the drama stopped there:

* DHH is not only considered racist / fascist due to some blog posts, but also for making Hyprland the default DE in Omarchy, developed by someone who goes by the name Vaxry Vaxerski, who is also considered fascist and racist, and thus banned from contributing to freedesktop projects due to supposed breach of CoC:

https://blog.vaxry.net/articles/2024-fdo-and-redhat

* Hyprland and all its contributors are now also considered fascist from taking sponsorship money from 37signals, DHH's company, due to it being an important part of Omarchy.

https://account.hypr.land/sponsors

* Due to the fact that both DHH and Vaxry are both considered fascist / racist, Framework and its CEO (yes, that Framework) are now considered to be supporters of fascism, because Framework is sponsoring and supporting both Omarchy and Hyprland.

https://account.hypr.land/sponsors

* Cloudflare (yes, that Cloudflare) is considered to support fascism because they support Omarchy and the Ladybird webbrowser (which is a project also run by someone considered to be a fascist)

https://blog.cloudflare.com/supporting-the-future-of-the-ope...

* Last but not least, Tobi (Shopify CEO) and thus Shopify are also considered by many to be supporters of fascism when this drama started to unroll for standing by DHH no matter what when activists wanted to deplatform and ban DHH from his own creation (Ruby on Rails). Which makes the Ruby Central drama due to the involvement of Shopify even more interesting:

https://xcancel.com/tobi/status/1970944464303923687

Me? I want to hop in a time machine back to the 90s/early 00s before all this crap started and everybody was just generally nice to each other.

Re: Ruby core team takes ownership of RubyGems and Bundler

#183

Post by gls2ro »

shevy-java wrote: post #75

There are numerous questions here, but also a few answers. For instance, I pointed out days ago that Hiroshi Shibata did not act solo. Now this is confirmed - it was a matz directive. The main question to ask here is: could he not have made this open AND public from the get go? It would have lessened the confusion for some people. Unfortunately this also has a few added problems now, because ... say that you are an i…

Can you elaborate on sources about this:

> Now this is confirmed - it was a matz directive.

I did not see any confirmation in this annoucement, do I miss something?

Re: Ruby core team takes ownership of RubyGems and Bundler

#184

Post by majkinetor »

fifticon wrote: post #176
majkinetor wrote: post #166

Earlier quoted context omitted.

I guess something sinister is also an option...

well,yes, already that description is sinister; I might be getting too old.

That description is not sinister. Its just marketing. An example of sinister would be to sell those logs to someone who could instigate a supply chain attack targeting some of those companies.

Re: Ruby core team takes ownership of RubyGems and Bundler

#185

Post by rich_kilmer »

Mystery-Machine wrote: post #145
rich_kilmer wrote: post #36

Earlier quoted context omitted.

They did not WRITE RubyGems, they inherited it and evolved it. Chad, David, Jim (RIP), Paul and I wrote RubyGems. I hosted RubyGems from my home in Virginia for several years before we could cover the cost of colocation and stood up RubyForge. Its nice to look at the near history and think that this is all of history but it is not. Ruby Central has always been the stewards of RubyGems and then later, Bundler.

First of all, thank you! It's unbelievable that you built the first version of `gem install` in a single night. It must have been an amazing feeling. I remember the drive when I was doing some hackathon with a few friends. It's the best feeling a software engineer can have. When you left RubyGems and Bundler (let's call them "Projects") team, you handed over your authority to whoever was left and/or was added later.…

I totally understand and agree that it was handled very poorly.

Re: Ruby core team takes ownership of RubyGems and Bundler

#186

Post by philipallstar »

mindcrash wrote: post #182
shadowgovt wrote: post #57

Earlier quoted context omitted.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

If only the drama stopped there: * DHH is not only considered racist / fascist due to some blog posts, but also for making Hyprland the default DE in Omarchy, developed by someone who goes by the name Vaxry Vaxerski, who is also considered fascist and racist, and thus banned from contributing to freedesktop projects due to supposed breach of CoC: https://blog.vaxry.net/articles/2024-fdo-and-redhat * Hyprland and all…

> Hyprland and all its contributors are now also considered fascist from taking sponsorship money from 37signals

This methodology is definitely not how you discover fascism. But it is how fascists and communists defined and traced their enemies in the 20th century.

Re: Ruby core team takes ownership of RubyGems and Bundler

#187

Post by MatthiasPortzel »

joshmn wrote: post #46

This is the only outcome that anyone who touches ruby cannot be upset with.

This is only a win for Ruby Central. They haven't conceded anything and they've convinced Ruby Core to endorse them as the correct and true maintainers of RubyGems.

> While repository ownership has moved, Ruby Central will continue to share management and governance responsibilities for RubyGems and Bundler in close collaboration with the Ruby core team.

Andre has previously maintained that he owns a trademark on Bundler and he will enforce it against Ruby Central.

=> https://andre.arko.net/2025/09/25/bundler-belongs-to-the-rub...

So Ruby Central transfers "ownership" of Bundler to Ruby Core. Ruby Central gets to continue to maintain Bundler, and Ruby Core is stuck with the liability. If Andre wants to enforce his trademark, he now has to sue Japan-based Ruby Core and risk the bad optics of that.

Re: Ruby core team takes ownership of RubyGems and Bundler

#188

Post by ivan_gammel »

lelanthran wrote: post #181
ivan_gammel wrote: post #69

Earlier quoted context omitted.

The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become si…

> The key question here is how exactly the supply chain attacks will be prevented By using signed packages. Why is this even a question.

If it’s PKI and there’s verification on each stage, maybe. Just different sort of centralization. If keys are self-issued, it’s still a problem. Say, you add a new dependency from a repository XXX. A new version is released signed by another key, which appears to be legitimate. What are you going to do? Run full KYC on new credentials? Distrust the new dependency version and fork the library? Just ignore assuming that repo has verified it?

With central repo you may expect that they operate under increasingly stronger security standards and even if you missed malicious update, there’s higher chance that it was taken down by someone else. In decentralized environment your risks are higher and attention surface bigger.

Re: Ruby core team takes ownership of RubyGems and Bundler

#189

Post by dash2 »

blibble wrote: post #170
brightball wrote: post #83

Earlier quoted context omitted.

He's also in a bit of a unique situation because of his public political profile was essentially forced. - Politics at work were becoming a huge problem at 37Signals - They asked that politics be kept out of company chats, but encouraged people to be political active on non-work channels/social media/etc even during work hours - People lost their minds at this incredibly reasonable request which then blew up on the i…

I more or less agree with the "no politics at work" stance but you've omitted his recent "contributions", where he went completely off the rails have a read of this https://world.hey.com/dhh/as-i-remember-london-e7d38e64 it's completely unacceptable, and he's promoting a self proclaimed fascist white nationalist (Tommy Robinson)

That's not quite accurate. Quoting chatGPT, since it may have more credible neutrality than my own opinion:

""" Does Tommy Robinson call himself a "fascist" or "white nationalist"?

No — Tommy Robinson (real name Stephen Yaxley-Lennon) does not call himself a fascist or white nationalist. He consistently rejects those labels, describing himself instead as a patriot, free-speech activist, or anti-Islamist campaigner. To summarize the record:

* Public statements:

Robinson has said things like “I’m not a racist, I’m not a fascist — I’m a working-class lad from Luton who’s standing up for my country.” In interviews (e.g., BBC Panorama, ITV, and various YouTube appearances), he has explicitly denied being a fascist or white nationalist.

* Affiliations:

He co-founded the English Defence League (EDL), which has been widely described by journalists and researchers as far-right and anti-Muslim.

However, he left the EDL in 2013 saying it had become associated with racism and extremist elements he could no longer control. """

Maybe TR is a fascist or white nationalist, but he isn't a self-proclaimed one.

Re: Ruby core team takes ownership of RubyGems and Bundler

#190

Post by charcircuit »

dluan wrote: post #11

In the long run, having multiple sources like gem.coop is probably a safer and more robust solution. But for RubyGems specifically, the trust was fully lost, through several layers - maintainers, community members, sponsors, etc. There's still open questions that probably need to be resolved like the funding and data privacy stuff, but I think most folks in ruby land will be supportive of this.

>multiple sources is safer

It tripples the attack surface making it more vulernable to having security vulnerabilities.

Post reply on HN