Earlier quoted context omitted.
By not addressing HOW the project ended up in RC's hands, Matz is effectively whitewashing the move.
When I see opinions like this, I run, not walk, away from the community in question.
Loved the... argument?
Ruby core team takes ownership of RubyGems and Bundler
201–210 of 407 posts
Re: Ruby core team takes ownership of RubyGems and Bundler
#202Earlier quoted context omitted.
I'm sure it's a total coincidence that Shopify (on whose board DHH sits) coincidentally became an active participant on toppling the maintainers soon after they criticized DHH. Given the power dynamics, the burden of proof is on Shopify to proove it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.
What you believe and what you can document are two separate things. Per the concept of "innocent until proven guilty", there is no burden on Shopify to prove they didn't do what you believe. The burden is on you to provide evidence for the motivations behind their actions. I personally doubt Tobi got Shopify to where it was by making rash decisions based on emotions and drama.
Not only does one have to do the right thing, one has to be seen doing the right thing, because actual malfeasance and the appearance of malfeasance are indistinguishable on the outside. Though I wouldn't be surprised if Tobi/Shopify doesn't care for what the little people think, so this rule-of-thumb may not apply.
Your second para is appeal to authority. A former CEO of mine (not a billionaire though, but a mere centimillionaire) was a drama magnet, thin-skinned, and a vengeful little shit.
Re: Ruby core team takes ownership of RubyGems and Bundler
#203Earlier quoted context omitted.
The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become si…
> The key question here is how exactly the supply chain attacks will be prevented By using signed packages. Why is this even a question.
Can Gems be served from OCI Container/Artifact registries, which (also) already support signatures?
From https://news.ycombinator.com/item?id=44991636 :
> Native Containers are bare-metal host images as OCI Images which can be stored in OCI Container Registries (or Artifact registries because packages too). GitHub, GitLab, Gitea, GCP, and AWS all host OCI Container/Artifact Registries
So, packages there too would simplify.
Re: "RPM 6.0 Released with OpenPGP Improvements and Signature Checking by Default" (2025) and Sigstore and PyPI and SLSA.dev and key revocation transparency: https://news.ycombinator.com/item?id=45354568
Nerdctl supports various snapshot, lazy start, and distributed cloud storage container stores: https://news.ycombinator.com/item?id=45270468
Ruby has:
gem cert --build your@email.com
gem install gemname -P HighSecurity
sigstore-ruby: https://github.com/sigstore/sigstore-ruby
guides.rubygems.org/trusted-publishing: https://guides.rubygems.org/trusted-publishing/ :
> Trusted publishing is a mechanism for uploading gems to RubyGems.org without using long-lived secret credentials. [..]
> Trusted Publishing is a term for using OpenID Connect (OIDC) to exchange short-lived identity tokens between a trusted third-party service and RubyGems.org. This allows obtaining short-lived API tokens in an automated environment (such as CI) without having to store long-lived API tokens or username/password credentials.
Re: Ruby core team takes ownership of RubyGems and Bundler
#204Earlier quoted context omitted.
Matz is a pillar. Remember "Matz is nice and so we are nice"? s/nice/nice and responsible/gc.
Is that a religion now? The pickaxe guys coined it. People repeat it without thinking about it. If matz were to say "jump from the bridge", people would do it, because matz is nice? Just to point out: I do think matz is nice and a great language designer. That in itself doesn't mean anything. Why would I proxy my own decisions based on any mindless slogan? That makes no sense. Why do people in the ruby ecosystem keep…
> Why would I proxy my own decisions based on any mindless slogan?
Exactly, why would you? But ignoring a hypothetical communal bridge jumping situation, do you have a problem with Matz having stewardship over RubyGems? Use your own thinking. If you're okay with it, then... is it because Matz is nice?
Re: Ruby core team takes ownership of RubyGems and Bundler
#205Earlier quoted context omitted.
This is just the tooling though, not "rubygems.org" which is still owned by a hostile entity (depending on where you sit on this), so not sure how this would restore any trust?
Hostile entity? The entity that has literally hosted them for their entire existence?
Imagine if you opened up your laptop to discover Microsoft windows has locked you out of a your entire machine, because you were writing a novel in RTF and it could be opened in Microsoft Word. Microsoft's executives started posting they "took control of the your machine/the novel to maintain security".
- Corporate entity doesn't have copyright over your creative output. Just because word can open and view ("run") your novel does not give them ownership.
- Locking your access completely on your resources would be akin to a ransomware attack or account compromise
Would you label those actions hostile? Or just accept it as right because "maintain security"?
If you would label the above hypothetical actions as hostile (if not outrageous overreach, something akin to theft?); what is fundamentally different to what Ruby Central did by taking over the source code of a GitHub repository?
Re: Ruby core team takes ownership of RubyGems and Bundler
#206Earlier quoted context omitted.
For context, also check out their previous statement from September 19, which also "reflects our shared commitment to the long-term stability and growth of the Ruby ecosystem" [sic]: https://rubycentral.org/news/strengthening-the-stewardship-o...
> As the nonprofit steward of this infrastructure, Ruby Central has a fiduciary duty to safeguard the supply chain and protect the long-term stability of the ecosystem. In consultation with legal counsel and following a recent security audit, we are strengthening our governance processes, formalizing operator agreements, and tightening access to production systems. It took less than two weeks from this statement for…
Genuine question: how do you take something which you have already been paying for?
They removed other maintainers access to their AWS account, and one of them had allegedly taken a screenshot of the root password from a password manager and logged in a few hours later and changed the root password to lock the legal owners out. Most of the community has turned on the maintainer who did that, it was extremely childish behaviour.
Re: Ruby core team takes ownership of RubyGems and Bundler
#207Earlier quoted context omitted.
Is that a religion now? The pickaxe guys coined it. People repeat it without thinking about it. If matz were to say "jump from the bridge", people would do it, because matz is nice? Just to point out: I do think matz is nice and a great language designer. That in itself doesn't mean anything. Why would I proxy my own decisions based on any mindless slogan? That makes no sense. Why do people in the ruby ecosystem keep…
I think it's pretty obvious to see the difference between being nice and jumping off a bridge? Curious why this cute phrase bothers you so much.
The phrase has been weaponized in the past many times. Some figures in the community are almost as far from "nice" as possible, but you're not allowed to call that out, because "it's not nice".
Re: Ruby core team takes ownership of RubyGems and Bundler
#208Since Ruby Central is still very much involved, does (or would) this have any impact on the people who left recently (like Ellen Dash/duckinator)?
seems to me they can happily go back to contributing to the tools, and at the same time ignore the fact that rubygems.org exists, by running gem.coop or whatever else.
Do the former maintainers have full commit access?
Remember, this is what was taken in the middle of a discussion about governance.
Re: Ruby core team takes ownership of RubyGems and Bundler
#209Earlier quoted context omitted.
For context, also check out their previous statement from September 19, which also "reflects our shared commitment to the long-term stability and growth of the Ruby ecosystem" [sic]: https://rubycentral.org/news/strengthening-the-stewardship-o...
They keep on using buzzwords. These Ruby central guys never maintained a single gem used by many people in their life. I have no idea what they are writing, but it feels as if AI is writing their statements. Even then it is of such a poor, repetitive quality that even AI may just accidentally write better "summaries". People lost all trust in Ruby Central - there is no way for them to win back trust here. IMO it woul…
Afaik many of the people who were on board to help start gem.coop have stepped back after the recent controversies with Andre Arko, at this point I don’t think it will ever be anything more than a ruby gems mirror
Re: Ruby core team takes ownership of RubyGems and Bundler
#210Earlier quoted context omitted.
What languages do you use that have adopted this well? I'm not counting something like C++ where there's effectively no "packages" to speak of.
Go, for some values of "distributed". The vast majority of go packages are hosted on GitHub, but nothing stops anyone from hosting elsewhere and Go has explicit support for indirection such that anyone can use a vanity domain that happens to point at GitHub or wherever.
go is comically un-distributed in practice:
- almost every package is hosted on GitHub and that url is baked in to consumers of those packages
- the go proxy: https://flak.tedunangst.com/post/what-the-go-proxy-has-been-...