Earlier quoted context omitted.
Those "histrionics" were your own words, slightly duplicated, with "say something like" added. While I don't disagree with this comment, I would recommend that you take the implied advice before expecting others to.
Dismissing someone's opinion because they compare those they don't agree with to literal fascists is not the same as dismissing someone's opinion because they do that. One leads to people being targeted for violence and potentially assassinated, the other calls out incitement to political violence.
Gem.coop
311–320 of 331 posts
Re: Gem.coop
#312Earlier quoted context omitted.
No. Imagine if someone came into your house and changed all of the locks on you/your family, because "security". You had built that house from your original designs but the other party claims they own it now because they happen to manage a series of rental listings for houses built to your design. You had even made it so the plans could be copied and modified in private; if "security" were a real concern with about 1…
Yeah and now we have a fragmented ecosystem. If the projects were placed under RubyCentral's management and active contributors' access is restored I don't see a big deal. Yes the manner in which it was handled was really bad but given the supply-chain attacks we're seeing against the Python and JS worlds, I think auditing contributor access and consolidating certain privileges is prudent. Again, handled poorly. But…
Re: Gem.coop
#313Earlier quoted context omitted.
This project is or will be a worker-owned co-op, as evidenced by the strict requirements placed on anyone who registers a .coop domain name. I imagine at least equal ownership (if not risk and power) is a given in this specific instance, and profits will explicitly not flow upwards to shareholders who are not also workers.
This likely won't last long, because it is at odds with human nature.
Re: Gem.coop
#314Earlier quoted context omitted.
Trustworthiness is far more important for a package manager. No amount of storage or bandwidth can compensate for an untrustworthy package manager.
TFA is about a new server/registry hosting for community gems. Not a fork of Bundler.
Re: Gem.coop
#315Earlier quoted context omitted.
1. GitHub dominance is a social phenomenon, not a technical requirement. The go.mod file you linked references ~14 different Git hosts other than GitHub. Go's design doesn't create this centralization; it merely reflects where developers choose to host code. 2. You complain about commit hashes while simultaneously noting that tags can be deleted and recreated. Hashes are precisely the solution to mutable tags. The "s…
> GitHub dominance is a social phenomenon Exactly. This 'social phenomenon' should have been taken into account when designing a packaging system so that the language's ecosystem does not end up entirely dependent on Microsoft due to 'social reasons'. > The go.mod file you linked references ~14 different Git hosts Of which the non-github ones account to what... 15% of the deps in the file? > You complain about commit…
> This 'social phenomenon' should have been taken into account when designing a packaging system
I'm unsure how this would be accomplished in practice without banning certain Git hosts, which seems untenable. Even Maven/Gradle ecosystems concentrate around a few major repositories (Maven Central, JCenter historically). This appears to be an inherent social dynamic rather than a solvable design problem.
> Of which the non-github ones account to what... 15% of the deps
Same question: what's the solution? Developers publish where it's easiest and most popular, creating a positive feedback loop. I don't see how package system design can prevent this.
> Not using versions (semver) is a bad call, and having people be able to mutate the code of a version is a very bad call
Agreed on both counts. However, how do we enforce immutability beyond operational controls? Even systems with "immutable" version policies ultimately rely on the registry operator honouring that policy. The only technical guarantee would be embedding content hashes alongside version numbers (which is effectively what go.sum does, albeit awkwardly).
Sidebar: how should we handle vulnerable versions? Allow pulling with warnings, or remove them entirely?
> Git's sha1 hashes are not a security tool and must not be used in place of code signing
Fair point. I was under the impression that Git had moved to SHA-256, but it seems there's no practical way to use it yet. While Git moved to a hardened SHA-1 implementation (not vulnerable to the SHAttered attack) in v2.13.0, SHA-1 remains weak for security purposes [1]. The transition to SHA-256 has been in the works for some time, but as of 2022 it appears to be a partial implementation with no support from major Git hosts [2].
What would ideal package security look like to you?
> They are also not good for versioning, as you can't deduce whether a commit introduces breaking changes
Completely agree. Repository references are useful for development and testing, but painful in production. I avoid them in published packages.
> See end of linked go.mod
Thank you, I see it now. I'm still deeply unfamiliar with Go but this feels like a legitimate criticism.
Glancing at github.com/tencentcloud/tencentcloud-sdk-go: is this import ambiguous because there's no top-level `go.mod`? If so, that feels like a significant oversight. I'm a fan of monorepos myself but I'm surprised Go doesn't have better support for them. I'll be doing some research to understand this better.
[1] https://git-scm.com/docs/hash-function-transition [2] https://lwn.net/Articles/898522/
Re: Gem.coop
#316Earlier quoted context omitted.
It's so crazy. He's a fascist because he said something about the chant population of London. And he didn't want politics at the work place How the hell is any of that facism
Fascism may be the wrong label. Racism could be a much better fit. The blog post in question: https://world.hey.com/dhh/as-i-remember-london-e7d38e64 The interpretation that raises some pretty interesting points about the inherent racism in the expressed worldview: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... There is, however, an interpretation that explains how this specific kind of racism can be…
I'm done letting these labels deter my rational thinking.
Re: Gem.coop
#317Earlier quoted context omitted.
I missed that. What happened?
https://joel.drapper.me/p/ruby-central-security-measures/
André is a better man than I. I wouldn't be able to resist making threats about turning off prod.
Re: Gem.coop
#318Earlier quoted context omitted.
Fascism may be the wrong label. Racism could be a much better fit. The blog post in question: https://world.hey.com/dhh/as-i-remember-london-e7d38e64 The interpretation that raises some pretty interesting points about the inherent racism in the expressed worldview: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug... There is, however, an interpretation that explains how this specific kind of racism can be…
If it's racist to say that we need controlled immigration to ensure the country can accommodate and integrate safely for _everyone_, then maybe it's ok to be a little racist. I'm done letting these labels deter my rational thinking.
The racist part was him asserting he could walk down the streets of London and guess who was British. Given the disparity between his estimated number and the actual percentage of Brits by census (and the remarkable similarity to his number and the probable skin color of Brits by census), it is real hard to find the generosity to assume that he doesn't just mean "When did the Brits stop being white?" And that kind of thinking has nothing to do with immigration control and everything to do with believing that there's a right skin color to have.
Re: Gem.coop
#319Earlier quoted context omitted.
If it's racist to say that we need controlled immigration to ensure the country can accommodate and integrate safely for _everyone_, then maybe it's ok to be a little racist. I'm done letting these labels deter my rational thinking.
That's not the racist part. The racist part was him asserting he could walk down the streets of London and guess who was British. Given the disparity between his estimated number and the actual percentage of Brits by census (and the remarkable similarity to his number and the probable skin color of Brits by census), it is real hard to find the generosity to assume that he doesn't just mean "When did the Brits stop be…
I'm Norwegian by the way and I belong to quite a small ethnic minority, but because of the color of my skin, people assume a whole lot of things about my background which isn't true. And I don't get to be proud about my heritage for some reason. Weird that.
Re: Gem.coop
#320Earlier quoted context omitted.
That's not the racist part. The racist part was him asserting he could walk down the streets of London and guess who was British. Given the disparity between his estimated number and the actual percentage of Brits by census (and the remarkable similarity to his number and the probable skin color of Brits by census), it is real hard to find the generosity to assume that he doesn't just mean "When did the Brits stop be…
He’s not saying the skin color is wrong. He’s saying it’s not ethnic British. Which is a thing. Same as there’s ethnic Japanese of which I am not one of. I can be a Japanese citizen but I cannot be Japanese. And that’s ok. Cultural and ethnic identity is a thing, except for some bizarre reason only ethnic minorities from specific origins get to have and observe that and not be called racist. Why is that? I'm Norwegia…
It doesn't take much 4D-chess reading of his actual words to infer, I think correctly, that he's saying it's not ethnic British... And that's wrong. At least wrong for him (and wrong for the Brits, since he goes on to assert that "it's tough to blame the Brits for being pissed").
"I thought I might move there [London] one day.
That was then. Now, I wouldn't dream of it. London is no longer the city I was infatuated with in the late '90s and early 2000s. Chiefly because it's no longer full of native Brits."
... I mean, I'm having a real hard time finding a reading for those sentences that isn't "I was more comfortable when Britain was full of native Brits and I am not comfortable now." If I assume your assertion that he means ethnicity, not culture or citizenship-birth... What the hell, DHH? What is it about "non-ethnic Brits" that is giving you the heebie-jeebies?
> can be a Japanese citizen but I cannot be Japanese.
That's going to be a difference of definition. If I may, "I can be a Japanese citizen but I cannot be ethnically Japanese."
And whether that's true or not: this is perhaps a thing that Japanese people can have traditionally, or Danes. It would be the height of hypocrisy, given the Empire's history, for the Brits to do this, and DHH is swimming way outside his lane opining on how Britain should be or what makes him, a non-Brit, most comfortable in London.
Do you want to know when the Brits stopped "looking British?" Around the time Victoria crowned herself Empress of India, creating a country of about 28.9 million "ethnic Brits" (I'm going to speak loosely here, and my Irish and Welsh cousins will give me a proper thrashing for it later) and 250 million "ethnic Indians." And the fact India later gained its independence again has no bearing on the people who are Brits who look "non-ethnic" because of 90 years of British rule of a subcontinent. If DHH, or the British, or anyone want someone to blame for Britain suffering a "demographic nightmare" (whatever the hell that means)... They can probably blame the Widow of Windsor.
> Why is that?
Because some nations were expansionist and some were isolationist. Ethnic and national identity lack 1-to-1 overlap, and that matters more in some nations than others. I'm not in the business of telling the Japanese how they should see themselves (if I were, I would be making meaningful harumphing noises about the easiest possible way to curb their apparent birthrate crisis...). But DHH has put himself in the business of telling Brits how they should be seen, and in so doing he decided to wade into a conversation that makes him, yeah, the racist in the story.
He's free to walk it back any time he wants to stop causing controversy in the Ruby community so people can focus on the tech again.
> I'm Norwegian by the way and I belong to quite a small ethnic minority
Oh, you've opened quite a door. I want to guess but guessing feels rude so I will refrain. For what it's worth, every person I ever met while visiting Norway had a lot to be proud of (hell, waking up every day in that climate and giving death herself a middle finger is damn impressive to me!), so whoever is making you feel like you don't have a right to be proud of your heritage can probably pound sand.