Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

351–360 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#351

Post by soraminazuki »

tptacek wrote: post #330
soraminazuki wrote: post #327

Earlier quoted context omitted.

The term you're looking for is a loaded question . https://en.wikipedia.org/wiki/Loaded_question Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.

I love that you had to link to the Wikipedia question for "loaded question" for this. So you're saying, the answer is "yes": he logged into the root account, after he lost access to his own account, and changed the root password. OK then! Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they…

The world doesn't line up with lies and spins of the most transparently corrupt actors either.

Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash.

When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror.

And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.

Re: Ruby core team takes ownership of RubyGems and Bundler

#352

Post by bgwalter »

tptacek wrote: post #330
soraminazuki wrote: post #327

Earlier quoted context omitted.

The term you're looking for is a loaded question . https://en.wikipedia.org/wiki/Loaded_question Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.

I love that you had to link to the Wikipedia question for "loaded question" for this. So you're saying, the answer is "yes": he logged into the root account, after he lost access to his own account, and changed the root password. OK then! Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they…

Always on the side of the bureaucracy and against the individual, no matter if it is IETF vs. Bernstein or Ruby Central vs. Arko?

Personally I also think the monetization proposal was silly, but that was in August and Ruby Central rejected it.

He logged into the root account because he thought he was on call and that someone was taking over Ruby Central, so he reacted in real time. With the obvious chaos and incompetence in Ruby Central and the ill defined takeover that does not seem far fetched.

What exactly would he have gained by openly changing the root account for malicious reasons? He knows he would have been found out. It is not even a hack.

Re: Ruby core team takes ownership of RubyGems and Bundler

#353

Post by kmacdough »

yawaramin wrote: post #325
soraminazuki wrote: post #324

Earlier quoted context omitted.

You take issue with me using 148 words in my comment? Just 8 hours before you wrote that, you spent more words than I did downplaying problems with AI powered mass surveillance cameras. Are rules something you live by or something that you arbitrarily impose on others? It’s telling that you can write multiple paragraphs claiming the moon is made of cheese while expecting others to communicate only in brief, misleadin…

It's a yes or no question.

A question that was already asked and answered. The only reason to re-ask seems to be to pull it from context and apply black/white arguments to a complex sociopolitical event.

Re: Ruby core team takes ownership of RubyGems and Bundler

#354

Post by gls2ro »

ufmace wrote: post #285
notepad0x90 wrote: post #215

Other than personal preference, are there any features that make Ruby worth considering for new apps? As a user, my experience with gems hasn't been great. I don't know any Ruby, I'm just asking out of curiosity.

Ruby by itself is still a pretty decent scripting language. I still think Rake is highly underrated as a command runner. Rails is still a good web framework within its limits. If you want to build a small, modest complexity web app with like 1 or 2 developers and under maybe 6 months of active development, modest traffic needs, etc, it's a good way to get everything up and running fast with best-practices for everyth…

> If you want to build a small, modest complexity web app with like 1 or 2 developers and under maybe 6 months of active development, modest traffic needs, etc, it's a good way to get everything up and running fast with best-practices for everything.

Of course lets silently ignore Github, Gitlab, Shopify and others: all small, modest complexity web apps built with Ruby on Rails. Look at Shopify last year black friday numbers and come back and tell us how Ruby is fit only for modest traffic.

Re: Ruby core team takes ownership of RubyGems and Bundler

#355

Post by binary132 »

ivan_gammel wrote: post #188
lelanthran wrote: post #181

Earlier quoted context omitted.

> The key question here is how exactly the supply chain attacks will be prevented By using signed packages. Why is this even a question.

If it’s PKI and there’s verification on each stage, maybe. Just different sort of centralization. If keys are self-issued, it’s still a problem. Say, you add a new dependency from a repository XXX. A new version is released signed by another key, which appears to be legitimate. What are you going to do? Run full KYC on new credentials? Distrust the new dependency version and fork the library? Just ignore assuming tha…

Whence this idea that Web of Trust is an unsolved useless design that requires central certificate authorities?

The fact is that even the “canonical” CA’s can’t be automatically trusted, but here we are. CA is just one shitty implementation of WoT that has been near-universally imposed on us and most people simply accept as a necessity of life, but it isn’t necessarily the only way. It’s just how it is right now.

Re: Ruby core team takes ownership of RubyGems and Bundler

#356

Post by binary132 »

zrail wrote: post #174
cortesoft wrote: post #140

Earlier quoted context omitted.

Isn't this the same as ruby gems, then? You can use alternative sources in your Gemfile pretty easily.

Sort of. Go packages have the source baked into the package name. It would be like needing to say `require "github.com/sparklemotion/nokogiri"` rather than what we do today, `require "nokogiri"` and then if you want to change the source wrapping `gem "nokogiri"` in an alternate `source` block.

This is why Go’s dependency management doesn’t really qualify as “decentralized” in my mind. A decentralized provider (IPFS?) could possibly be implemented for some packages, but most of its packages are locked into centralized hosting and URLs today. Some of them sometimes being hash-identified and cache-proxied doesn’t help the case much and IMO the centralized proxying by default actually hurts it.

Re: Ruby core team takes ownership of RubyGems and Bundler

#357

Post by busterarm »

tptacek wrote: post #330
soraminazuki wrote: post #327

Earlier quoted context omitted.

The term you're looking for is a loaded question . https://en.wikipedia.org/wiki/Loaded_question Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.

I love that you had to link to the Wikipedia question for "loaded question" for this. So you're saying, the answer is "yes": he logged into the root account, after he lost access to his own account, and changed the root password. OK then! Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they…

I'm shocked because you and I hardly ever agree on anything, but here we are in lock step.

The HN commentariat is really shocking me here, because everyone in the professional space that I talk to about this thinks this is obvious and takes the same position.

I won't follow the thought from there, but maybe you see where I'm going...

Re: Ruby core team takes ownership of RubyGems and Bundler

#358

Post by binary132 »

shadowgovt wrote: post #73
zrail wrote: post #45

Earlier quoted context omitted.

Go, for some values of "distributed". The vast majority of go packages are hosted on GitHub, but nothing stops anyone from hosting elsewhere and Go has explicit support for indirection such that anyone can use a vanity domain that happens to point at GitHub or wherever.

Go's one weakness is that the package source is baked into the package data in a not-automatically-fungible way. And if pkg.go.dev ever becomes a threat vector, we're gonna have a bad time. dselect solved this ages ago with its mirrors, but at some point it seems every major package manager decided that was unnecessary complexity ("why bother? It's not like a package repo just goes down ") and left it out when they b…

Depending on your definition of “threat” I’d definitely consider it a threat vector already.

Re: Ruby core team takes ownership of RubyGems and Bundler

#360

Post by notepad0x90 »

gls2ro wrote: post #354
ufmace wrote: post #285

Earlier quoted context omitted.

Ruby by itself is still a pretty decent scripting language. I still think Rake is highly underrated as a command runner. Rails is still a good web framework within its limits. If you want to build a small, modest complexity web app with like 1 or 2 developers and under maybe 6 months of active development, modest traffic needs, etc, it's a good way to get everything up and running fast with best-practices for everyth…

> If you want to build a small, modest complexity web app with like 1 or 2 developers and under maybe 6 months of active development, modest traffic needs, etc, it's a good way to get everything up and running fast with best-practices for everything. Of course lets silently ignore Github, Gitlab, Shopify and others: all small, modest complexity web apps built with Ruby on Rails. Look at Shopify last year black friday…

But would they still build with Ruby if they had to rewrite it today? It seems other commenters are saying they wouldn't. I wanted to see if it offered anything more than my python and Go preference.
Post reply on HN