271–280 of 331 posts
Earlier quoted context omitted.
I don't plan on switching to a rubygems fork that does not offer technical/security benefits over the original. They can win me over with a gem distribution site that requires code signing out of the box and a bundler that enforces it out of the box.
They had a minor security incident right off the bat, demonstrating they don’t even fully understand what they stole. They aren’t equipped to do the job.
Earlier quoted context omitted.
Again, link? It's no good just talking about what heinous things someone has done. That kind of talk is always incredibly unreliable.
Evidence for thee, but not for me? You write with such authority on this topic, yet you insist on demanding evidence for even the most basic knowledge surrounding it. https://www.bbc.com/news/articles/cm2njjm4e2po https://xcancel.com/jk_rowling/status/1819007216214573268 https://xcancel.com/jk_rowling/status/1931144695771435140 Also, on another note, here's one of her many posts from JKR literally equating trans wome…
And as for that incident, "spreading lies" is clearly an exaggeration. That boxers gender is at best debatable. She's clearly on the awkward boundary between genders that sport (and society in general) doesn't really know how to deal with.
> literally equating trans women with sexual predators
Not what she was saying. She was calling out an only-true-scotsmen argument.
I feel like a change to the way gems are distributed/downloaded could fix this. Unfortunately, the very powers that could make that happen are the powers that control the software and infrastructure, and have the least incentive to improve things. I honestly find it ridiculous that this situation happened to begin with, and I also have no clue why people are hating on DHH. The easiest way to kill an open source proje…
As for DHH, he's a far-right racist.
https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug...
Silencing and excluding such people from open source is the right thing to do because failure to do so means forcing others to interact with people who are hostile to their very existence.
So RubyGems has betrayed its community by ousting its maintainers. When a community-focused alternative created by the original maintainers is announced, it gets flagged on HN. What is wrong with people? This situation is eerily similar to the Freenode takeover[1] and the subsequent formation of Libera Chat[2] a few years ago, even down to the political leanings of those behind the takeover. Except if the Freenode in…
I could be wrong but it may be that some have an additional agenda to try to make e. g. competition to Ruby Central fail. You can see this on ruby-reddit, e. g. by u/f9ae8221b - either way I think the by far best strategy for gem.coop is to address all concerns and statements made, including the wrong ones. Simply be better than rubygems.org - everywhere. (Also, u/f9ae8221b is super-impatient; why can't he wait for a…
Earlier quoted context omitted.
That's the part where the term "fascist" is misused to smear somebody they disagree with. It can be safely ignored.
I thought so but didn’t want to assume. People really like to misuse terms like fascism these days, huh…
How the hell is any of that facism
Earlier quoted context omitted.
> but silence is a form of opinion, of vote, of approval. I disagree. We don't have to have an opinion on everything. And what worries me is those (both on the left and on the right) who think that silence is a form of opinion or approval. It's getting very close to "those who are not with us are against us". And that's a worldview I have very little time for.
> And what worries me is those (both on the left and on the right) who think that silence is a form of opinion or approval. Definitely definitely. When a racist paramilitary is disappearing my neighbors my primary concern is whether people will consider me complicit for publicly stating that I have no duty to interfere. You don't have to have an opinion on everything but you do have to have an opinion on some things.…
If you believe we shouldn't have borders than just say so.
Earlier quoted context omitted.
If who you vote for will put me into a torture camp (or otherwise devalues my life or personhood), then I can't work with you, so no it is not irrelevant. (neither the "me" nor the "you" here refer to you or me personally ofc.)
"will put me into a torture camp" for sure, but "devalues my life or personhood" is pretty vague. So, for example, if I value guns and consider them necessary for my well being and personal safety, should I refuse to work with anyone who votes for increased gun control? This sounds like a recipe for very fragmented, unstable society.
Earlier quoted context omitted.
People would be less inclined to say ridiculous things like this if they didn't keep happening.
When was the last torture camp in the USA?
Earlier quoted context omitted.
Let's review for example Traefik's dependency list: https://github.com/traefik/traefik/blob/master/go.mod 1. Heavy dependency on Github. AKA Microsoft owns much of the golang ecosystem. Not just the source... The package distribution as well! 2. Many packages are referencing a git (short!) commit hash instead of a version. It still boggles my mind that this is an acceptable practice. Not to mention that git tags can…
1. GitHub dominance is a social phenomenon, not a technical requirement. The go.mod file you linked references ~14 different Git hosts other than GitHub. Go's design doesn't create this centralization; it merely reflects where developers choose to host code. 2. You complain about commit hashes while simultaneously noting that tags can be deleted and recreated. Hashes are precisely the solution to mutable tags. The "s…
Exactly. This 'social phenomenon' should have been taken into account when designing a packaging system so that the language's ecosystem does not end up entirely dependent on Microsoft due to 'social reasons'.
> The go.mod file you linked references ~14 different Git hosts
Of which the non-github ones account to what... 15% of the deps in the file?
> You complain about commit hashes while simultaneously noting that tags can be deleted and recreated
Yes. Not using versions (semver) is a bad call, and having people be able to mutate the code of a version is a very bad call. Once a version has been tagged, the only viable choice must be to pull that version and push a new higher version.
> As for "secure package distribution," go.sum files verify files verify consistent downloads
Based on git's hash.
> Git uses sufficient entropy that collisions are not a practical concern
Unless crafted by an adversary? Git's sha1 hashes are not a security tool and must not be used in place of code signing.
They are also not good for versioning, as you can't deduce whether a commit introduces breaking changes. Rubygems has the ability to reference git repos. It's always a pain to update these compared to other semver deps -- you have to go to github and do a comparison between the old and new hashes to try and deduce whether bumping this will break you.
> Can you provide a concrete example of an ambiguous import you've encountered
See end of linked go.mod