Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

111–120 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#111

Post by shevy-java »

elliotec wrote: post #6

This is a fascinating and seemingly unusual development that will look obvious in history. I find “BDFLs” and open source communities so incredibly interesting. Especially in the context of geopolitics and state entities. Linux! This stuff is PHD material for sociology and polisci post-grads and I’m so interested in following the progression of history with these types of things.

I don't think BDFLs are a problem. Nobody questioned, say, guido design of python or matz' design of ruby as such. The issue here is primarily about who controls the ruby ecosystem. Interestingly python also had a somewhat similar discussion in the past; you can see this indirectly if you look at pypi:

https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2f...

See that question asked:

"Isn't supply chain security a corporate concern?"

He tries to bring arguments to invalidate that. And failed in an epic manner. Now people are more suspicious than before. Kind of strange to see, too.

Re: Ruby core team takes ownership of RubyGems and Bundler

#112

Post by mcphage »

mring33621 wrote: post #85
mring33621 wrote: post #72

NGL, the drama is entertaining. I'm sorry for Ruby people that are negatively impacted, tho. Lastly, Matz is the best!

So this whole thing stems from a dislike of DHH? It also seems like rubygems.org could simply fork the rubygems code, perform whatever 'security and governance' changes they believed were needed in their fork, and run with that? Isn't that the open source way of handling disagreements in direction?

> So this whole thing stems from a dislike of DHH?

I don't believe this has anything to do with DHH.

Re: Ruby core team takes ownership of RubyGems and Bundler

#113

Post by rich_kilmer »

shevy-java wrote: post #82
rich_kilmer wrote: post #32

Earlier quoted context omitted.

As a co-author of RubyGems and one of the original Board members of Ruby Central, they are not a hostile entity. They are the entity that we gave stewardship of RubyGems and we/they have hosted it for its entire existence.

I disagree. The actions are orthogonal to your claim - they eliminated everyone else from there. How is that not hostile? Duckinator has been 100% right here. > we gave stewardship of RubyGems I didn't sign anything. I also remember the original creators of rubygems. How old is Ruby Central? 10 years? 15 years? There were several years before that.

Ruby Central started in 2001. I was one of the early Board members, along with Chad Fowler and David Alan Black. We put on every Ruby conference until Ruby became more popular to support multiple conferences. We started coding RubyGems (although the name originated in 2001 at the first RubyConf in Florida) in 2003 at the RubyConf in Austin TX. We sat around a table the first night with a CVS repo on a USB drive and passed it around and committed code until we had a functioning gem command. I demoed it in my talk the next day with the first "gem install". Gem versioning, gemspec, gem command, gem server were all built that first night. Obviously tons of changes since then!

Re: Ruby core team takes ownership of RubyGems and Bundler

#114

Post by leleat »

monooso wrote: post #64
voxic11 wrote: post #44

Earlier quoted context omitted.

Go has decentralized package hosting and it works reasonably well. Deno does also but I'm less clear on well how that is working out for them.

The Deno people recently released jsr.io, "a modern package registry for JavaScript and TypeScript." I'm not familiar with the technical details, but at first glance it appears pretty centralised.

Technically, deno supports https imports as well

https://docs.deno.com/runtime/fundamentals/modules/#https-im...

Re: Ruby core team takes ownership of RubyGems and Bundler

#116

Post by shevy-java »

ivan_gammel wrote: post #69
binary132 wrote: post #16

Decentralized package hosting is the only way.

The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become si…

The supply chain attack is not the only argument here, though.

For instance, who effectively controls the ruby ecosystem? See ad-hoc restrictions such as 100.000 downloads - past that point you are disowned from your own gem. I always felt that was a direct attack on independent developers. They could have forked those gems just fine (the licence permits this for most gems after all), but nope, they forbid you to remove your own (!!!) code.

Re: Ruby core team takes ownership of RubyGems and Bundler

#117

Post by shevy-java »

itsnowandnever wrote: post #31

this is good and I hope this puts a lot of the drama in the rearview mirror. younger developers coming across Ruby must be like "wtf" about this situation. very peculiar to have these projects so politicised and I say that to the people that "try and keep politics out" (DHH) more than anyone. making your politics known and then being like "but you're not allowed to have an opinion on it" is't cute or clever. it's chi…

But how does this solve anything? People will still not trust Ruby Central. And rubygems.org is under control by Ruby Central, even IF ruby core tries to jump in to the rescue.

Re: Ruby core team takes ownership of RubyGems and Bundler

#118

Post by busterarm »

nxor wrote: post #103
xg19837 wrote: post #98

Earlier quoted context omitted.

Yes. At least Ruby was always strongly Japanese though. In Python European and Asian developers are overtly exploited, with U.S. corporations and their employed stooges holding the reins of power. I'm considering switching to Erlang, which was developed at a corporation from the start and appears to be drama and cancel free.

Or Europeans choose to work for US corporations. What am I missing? I know Europeans who only want to work for American companies.

Different money and different attitudes. Trying to get paid more than your peers if you're appropriately skilled isn't social kryptonite here in the states.

Re: Ruby core team takes ownership of RubyGems and Bundler

#119

Post by gmac »

delichon wrote: post #90
shevy-java wrote: post #80

Earlier quoted context omitted.

Is that a religion now? The pickaxe guys coined it. People repeat it without thinking about it. If matz were to say "jump from the bridge", people would do it, because matz is nice? Just to point out: I do think matz is nice and a great language designer. That in itself doesn't mean anything. Why would I proxy my own decisions based on any mindless slogan? That makes no sense. Why do people in the ruby ecosystem keep…

I know what you mean about mindless aspirational slogans. "No child left behind" is logically the same as "no child gets ahead". But trying to convince the Ruby community to be nice, by the example of their founder, isn't in that category. And if Matz told me to jump off of a bridge, he has enough stored up credibility that I'd at least consider it.

> "No child left behind" is logically the same as "no child gets ahead"

If by both statements you mean "all children must be in exactly the same position", yes ... but that's a wilfully obtuse interpretation.

Re: Ruby core team takes ownership of RubyGems and Bundler

#120

Post by brigandish »

ameliaquining wrote: post #87
shadowgovt wrote: post #57

Earlier quoted context omitted.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

This is missing an important part of the story that makes the Ruby Central side look relatively better, which is that one of the existing maintainers offered to help fill the funding gap in exchange for being allowed to monetize the server logs. https://rubycentral.org/news/rubygems-org-aws-root-access-ev...

That puts the gem.coop repo in a new light.
Post reply on HN