Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gem.coop

gem.coop

Post reply on HN
Print view View original

31–40 of 331 posts

Re: Gem.coop

#31

Post by phoronixrly »

burnt-resistor wrote: post #27
phoronixrly wrote: post #4

I hope they tackle the actual main issue with Rubygems -- lack of any sort of code signing... (I know the functionality exists, but it's not required to publish in Rubygems, and off by default on gem install. In other words it's as if it doesn't exist) The fash problem in the Rails ecosystem is next on the list, and I hope there is community consensus to fork this as well.

It has code signing. It's just optional, inconvenient, and so unused because of Tragedy of the Commons and complacency. https://guides.rubygems.org/security/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-you...

As I said, it's as good as no code signing. The very lack of a chain of trust stemming from rubygems that can be used to verify gem authenticity makes the whole thing useless.

Re: Gem.coop

#32

Post by phoronixrly »

KingOfCoders wrote: post #12
mosselman wrote: post #11

Earlier quoted context omitted.

How is rv threatening rubygems? I am pretty excited about rv on first glance, I tried it and it was too beta when I did to work nicely, but definitely good to have a uv type tool for ruby.

"Yes, I agree. And some of the “admins” even announced publicly many days ago they were launching a competitor tool and were funding raising for it. I’d not trust the system to such “admin”." https://bsky.app/profile/rmfranca.bsky.social/post/3lz7alpob... See https://spinel.coop/ "Spinel develops rv, the next-generation Ruby version manager"

This doesn't explain how rv is threatening rubygems in any way.

Re: Gem.coop

#33

Post by joeldrapper »

byroot wrote: post #15
wallmountedtv wrote: post #6

Earlier quoted context omitted.

In short, a hostile takeover forced by Shopify through Ruby Central. It was sparked after Ruby Central chose to platform an extremist figure prominently for their last RailsConf against the wishes of the sponsors, losing them a lot of sponsorship money, as well as community support. https://joel.drapper.me/p/rubygems-takeover/

> a hostile takeover forced by Shopify through Ruby Central. That's entirely unsubstantiated.

I heard it directly from people directly involved.

Re: Gem.coop

#35

Post by simianparrot »

phoronixrly wrote: post #4

I hope they tackle the actual main issue with Rubygems -- lack of any sort of code signing... (I know the functionality exists, but it's not required to publish in Rubygems, and off by default on gem install. In other words it's as if it doesn't exist) The fash problem in the Rails ecosystem is next on the list, and I hope there is community consensus to fork this as well.

What does “fash problem” mean?

Re: Gem.coop

#36

Post by [deleted] »

hiimkeks wrote: post #26
steve_gh wrote: post #25

I'm really pleased to see this happening, but sad that it has come to this. What I'd really like to see is a whole bunch of people acting more professionally. Who you pray to, who you vote for, and who you sleep with are irrelevant to a professional context - and open source development is a professional context. So everyone needs to keep their professional and personal lives separate. I know that at best I would be…

If who you vote for will put me into a torture camp (or otherwise devalues my life or personhood), then I can't work with you, so no it is not irrelevant. (neither the "me" nor the "you" here refer to you or me personally ofc.)

[deleted]

Re: Gem.coop

#37

Post by pil0u »

hiimkeks wrote: post #26
steve_gh wrote: post #25

I'm really pleased to see this happening, but sad that it has come to this. What I'd really like to see is a whole bunch of people acting more professionally. Who you pray to, who you vote for, and who you sleep with are irrelevant to a professional context - and open source development is a professional context. So everyone needs to keep their professional and personal lives separate. I know that at best I would be…

If who you vote for will put me into a torture camp (or otherwise devalues my life or personhood), then I can't work with you, so no it is not irrelevant. (neither the "me" nor the "you" here refer to you or me personally ofc.)

Agreed. Your example could sound like exaggerated, but silence is a form of opinion, of vote, of approval. Even in a professional context, because work is part of the society we live in.

This whole "DHH situation" with Rails has put my mind in weird position. I admire the Rails creator, the business man, the speaker. I admire what he builds, how passionate he is about his work and open-source software. But I very strongly disagree with his vision of immigration, nationalism, parenting, well most of his vision of society.

I was made aware about these opinions because people talked about it. Thanks to these people, I read and listen to him with more nuance, more critical thinking. That does not necessarily mean I would discard Rails, cancel the dude or write shit about him, but that surely means that I will be more careful about how the opinions of this 1 person could impact mine, the ecosystem I work with and the larger ecosystem I live in that is society.

Re: Gem.coop

#39

Post by halicarnassus »

Great move to counter the hostile takeover of the RubyGems GitHub repo (not the rubygems.org repo) and organization by Ruby Central.

I hope they find financing to cover hosting costs.

Re: Gem.coop

#40

Post by kortilla »

hiimkeks wrote: post #26
steve_gh wrote: post #25

I'm really pleased to see this happening, but sad that it has come to this. What I'd really like to see is a whole bunch of people acting more professionally. Who you pray to, who you vote for, and who you sleep with are irrelevant to a professional context - and open source development is a professional context. So everyone needs to keep their professional and personal lives separate. I know that at best I would be…

If who you vote for will put me into a torture camp (or otherwise devalues my life or personhood), then I can't work with you, so no it is not irrelevant. (neither the "me" nor the "you" here refer to you or me personally ofc.)

[flagged]
Post reply on HN