Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm leaving Ruby Central

gist.github.com

Post reply on HN
Print view View original

111–120 of 134 posts

Re: I'm leaving Ruby Central

#111

Post by bigiain »

rmoriz wrote: post #53
torben-friis wrote: post #28

Earlier quoted context omitted.

What I don’t get is, what does Shopify get from this? I’m assuming there’s a ton of reputational risk in this move, and my understanding as an outsider is that Shopify already has a ton of weight in the Ruby ecosystem - they seem to be the one case quoted by everyone as the “proof that Ruby scales”.

They are a multi-billion company that is highly dependent of RubyGems and a breach could ruin their business. So they have intrinsic reasons to support anything that keeps Ruby and Rails floating.

... so they locked out the main security contributor, and didn't see a need to replace them?

Re: I'm leaving Ruby Central

#112

Post by plorkyeran »

torben-friis wrote: post #28
jaredcwhite wrote: post #19

Earlier quoted context omitted.

In a word, yes.

What I don’t get is, what does Shopify get from this? I’m assuming there’s a ton of reputational risk in this move, and my understanding as an outsider is that Shopify already has a ton of weight in the Ruby ecosystem - they seem to be the one case quoted by everyone as the “proof that Ruby scales”.

We know very little about what happened between Shopify and Ruby Central. They said that they made no progress towards satisfying Shopify’s demands until they were 24 hours from the deadline, but not what those demands specifically were or why they failed to do anything. It’s possible that what they panickedly did at the last second wasn’t actually what Shopify had intended.

Re: I'm leaving Ruby Central

#114

Post by zorpner »

torben-friis wrote: post #28
jaredcwhite wrote: post #19

Earlier quoted context omitted.

In a word, yes.

What I don’t get is, what does Shopify get from this? I’m assuming there’s a ton of reputational risk in this move, and my understanding as an outsider is that Shopify already has a ton of weight in the Ruby ecosystem - they seem to be the one case quoted by everyone as the “proof that Ruby scales”.

DHH joined their board in 2024 [0], and is using this opportunity to purge people he disagrees with politically from the Ruby ecosystem. It really is as simple as that.

0: https://www.shopify.com/news/david-heinemeier-hansson-board

Re: I'm leaving Ruby Central

#115

Post by viraptor »

the__alchemist wrote: post #18

Tangent: IMO this is why you keep your repos under your account, and don't give them over to a group acct. Unless you no longer want/care about control, or things like this happening. If that's the case and you've moved on or are OK with moving on, then do the group account.

I'm large enough environments, it's not really safe to use individual accounts. A hack/takeover while someone's on holidays could take days to resolve. People leaving the project, getting sick, dying would cause havoc on processes and ownership. Once thousands of people depend on your project, you really should move it into an org with others.

Re: I'm leaving Ruby Central

#116

Post by charcircuit »

istjohn wrote: post #90
1a527dd5 wrote: post #24

Crazy to see that embrace, extend, and extinguish are still fundamental game plans. I guess the only lesson here is trust no one and keep your repos under your account.

How does this fit the EEE pattern? For reference, here is Wikipedia's description of EEE: > "Embrace, extend, and extinguish" ... is a phrase that the U.S. Department of Justice found was used internally by Microsoft to describe its strategy for entering product categories involving widely used open standards, extending those standards with proprietary capabilities, and using the differences to strongly disadvantage…

Also, that wikipedia quote is wrong as it wasn't used internally at Microsoft.

Re: I'm leaving Ruby Central

#117

Post by hosh »

hiharryhere wrote: post #98
hosh wrote: post #59

Earlier quoted context omitted.

That sounds like a neat idea. Do you have a proposal for that? Would it be compatible with specifying urls (such as git repos)?

Bundler already does this. # From a specific branch gem 'my_gem', git: 'https://github.com/user/my_gem.git', branch: 'development' # From a specific tag gem 'my_gem', git: 'https://github.com/user/my_gem.git', tag: 'v1.2.3' # From a specific commit (ref) gem 'my_gem', git: 'https://github.com/user/my_gem.git', ref: 'a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0'

Yes, I know bundler does that. But I thought we were talking about urn instead of uri. Seems I was mistaken.

Re: I'm leaving Ruby Central

#118

Post by paulddraper »

rmoriz wrote: post #76
paulddraper wrote: post #30

Earlier quoted context omitted.

> it was never clear what the niche of Ruby Ruby on Rails Chef --- Some of the largest websites in the world run on Ruby: GitHub and Shopify.

Chef seems to be almost dead. I'm still using it personally but don't know a single company in Germany still using it.

I was responding to “it was never clear”

Ruby was used, for example, as the DevOps language prior to Go

Re: I'm leaving Ruby Central

#120

Post by nenenejej »

rmoriz wrote: post #78
nenenejej wrote: post #48

The solution is to design package managers around the uniform resource identifier: a way to locate online assets that is mostly (ignoring DNS) decentralised and better than having one org own all the packages.

This resembles the "monolith" vs "micro-services" discussion. If you spread the packages over thousands of domains, hosts, providers, reliability will be horrible. And it's uncontrollable. In theory, RubyGems could run code analyzers on all uploads to detected malware. Good look if you just haven an index of repositories/packages hosted elsewhere.

Step 2: store a copy of the library in your repo.

Sounds nut? We used to do this with .dlls in sourcesafe and was fine. boring.

Post reply on HN