Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

381–390 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#381

Post by jcmfernandes »

tptacek wrote: post #379
jcmfernandes wrote: post #378

Earlier quoted context omitted.

I'm questioning why they didn't call him. Why? And why are you ignoring that RC did a hostile takeover of the repos? Again, RC stole the repos. What do you think of that?

Why in the everloving cosmic fuck did he not tell them ? In a great many circumstances what he did is a crime. Nobody's coming after him on this but if this was me I would paper the everloving fuck out of what I did so there wasn't even a possibility that the owner of the account had any uncertainty as to what happened. I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have…

I find your obsession over Andre's fault and disdain towards the stealing of the repos by RC amusing.

And you know what? I think you're right! What Andre did could constitute a crime. Any serious organization would lawyer up and go after him... right? RIGHT?

Re: Ruby core team takes ownership of RubyGems and Bundler

#382

Post by jcmfernandes »

dismalaf wrote: post #375
jcmfernandes wrote: post #370

Earlier quoted context omitted.

> It doesn't matter why you break into your former employer's server. Arko already stated that he didn't know he had been fired. Geez. > You know Arko didn't even start working on Rubygems until it was nearly 10 years old, right? The project was stolen from a set of maintainers, not just Arko. Let's stick to the facts: someone with admin rights over the repos revoked the access of other admins without their consent.…

> have a lot of respect for Rich, but he wasn't a maintainer. LMAO No. He's one of the few people on the planet that could lay claim to it's copyright. He also gave the insight that Rubygems has literally ALWAYS been a part of RubyCentral.

Copyright? WTF are you talking about? Who's talking about copyright? Did or didn't RC perform a hostile takeover of the repos?

Re: Ruby core team takes ownership of RubyGems and Bundler

#383

Post by tptacek »

jcmfernandes wrote: post #381
tptacek wrote: post #379

Earlier quoted context omitted.

Why in the everloving cosmic fuck did he not tell them ? In a great many circumstances what he did is a crime. Nobody's coming after him on this but if this was me I would paper the everloving fuck out of what I did so there wasn't even a possibility that the owner of the account had any uncertainty as to what happened. I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have…

I find your obsession over Andre's fault and disdain towards the stealing of the repos by RC amusing. And you know what? I think you're right! What Andre did could constitute a crime. Any serious organization would lawyer up and go after him... right? RIGHT?

Did you stop reading 2 sentences in to my last comment?

Re: Ruby core team takes ownership of RubyGems and Bundler

#384

Post by jcmfernandes »

tptacek wrote: post #383
jcmfernandes wrote: post #381

Earlier quoted context omitted.

I find your obsession over Andre's fault and disdain towards the stealing of the repos by RC amusing. And you know what? I think you're right! What Andre did could constitute a crime. Any serious organization would lawyer up and go after him... right? RIGHT?

Did you stop reading 2 sentences in to my last comment?

Do you want to debate or continue with the gaslighting?

Re: Ruby core team takes ownership of RubyGems and Bundler

#385

Post by dismalaf »

jcmfernandes wrote: post #382
dismalaf wrote: post #375

Earlier quoted context omitted.

> have a lot of respect for Rich, but he wasn't a maintainer. LMAO No. He's one of the few people on the planet that could lay claim to it's copyright. He also gave the insight that Rubygems has literally ALWAYS been a part of RubyCentral.

Copyright? WTF are you talking about? Who's talking about copyright? Did or didn't RC perform a hostile takeover of the repos?

Arko tried to copyright Rubygems and file a claim against RC. That's literally part of the issue here... Because the repo doesn't matter that much, it's OSS, you can fork...

But if you do care about the repo, once again, RC has always controlled Rubygems. From the day it was written. The maintainers were even paid by RC. That makes it RC's, not the maintainers'.

Re: Ruby core team takes ownership of RubyGems and Bundler

#386

Post by madeofpalk »

mindcrash wrote: post #182
shadowgovt wrote: post #57

Earlier quoted context omitted.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

If only the drama stopped there: * DHH is not only considered racist / fascist due to some blog posts, but also for making Hyprland the default DE in Omarchy, developed by someone who goes by the name Vaxry Vaxerski, who is also considered fascist and racist, and thus banned from contributing to freedesktop projects due to supposed breach of CoC: https://blog.vaxry.net/articles/2024-fdo-and-redhat * Hyprland and all…

This is all... your opinion? Or some random twitter poster? Is there an appreciable amount of folks considering all of these people and companies fascist / racist?

Re: Ruby core team takes ownership of RubyGems and Bundler

#387

Post by madeofpalk »

zer00eyz wrote: post #240
pebble wrote: post #52

Better Ruby core than Ruby Central but still leaves me wondering what the hell happened and slightly sours me on the whole ecosystem.

I spend most of my time writing go (among other languages). Candidly its decentralized nature when it comes to "packages" is one of its strengths. It does have downsides, and yes GitHub could be at issue at some point. After this, after NPM compromises (left pad and more recently the supply chain attacks) why we arent seeing more community driven changes around decentralization and venturing is beyond me.

I don't think anything about the NPM supply chain attacks has to do with it being centralised. If anything, it made it easier to heal as NPM could centrally remove the bad packages.

Re: Ruby core team takes ownership of RubyGems and Bundler

#388

Post by madeofpalk »

binary132 wrote: post #356
zrail wrote: post #174

Earlier quoted context omitted.

Sort of. Go packages have the source baked into the package name. It would be like needing to say `require "github.com/sparklemotion/nokogiri"` rather than what we do today, `require "nokogiri"` and then if you want to change the source wrapping `gem "nokogiri"` in an alternate `source` block.

This is why Go’s dependency management doesn’t really qualify as “decentralized” in my mind. A decentralized provider (IPFS?) could possibly be implemented for some packages, but most of its packages are locked into centralized hosting and URLs today. Some of them sometimes being hash-identified and cache-proxied doesn’t help the case much and IMO the centralized proxying by default actually hurts it.

Depends what you're trying to decentralise. Go has no centralised registry. The collective of all the packages are decentralised, but each individual package is centralised.

Re: Ruby core team takes ownership of RubyGems and Bundler

#389

Post by ivan_gammel »

binary132 wrote: post #355
ivan_gammel wrote: post #188

Earlier quoted context omitted.

If it’s PKI and there’s verification on each stage, maybe. Just different sort of centralization. If keys are self-issued, it’s still a problem. Say, you add a new dependency from a repository XXX. A new version is released signed by another key, which appears to be legitimate. What are you going to do? Run full KYC on new credentials? Distrust the new dependency version and fork the library? Just ignore assuming tha…

Whence this idea that Web of Trust is an unsolved useless design that requires central certificate authorities? The fact is that even the “canonical” CA’s can’t be automatically trusted, but here we are. CA is just one shitty implementation of WoT that has been near-universally imposed on us and most people simply accept as a necessity of life, but it isn’t necessarily the only way. It’s just how it is right now.

Web of Trust is highly theoretical concept, which is unlikely to scale well for millions of people. It's a technical solution to a people problem and we barely solved this people problem already (to a few nines, but not absolutely) - through a sophisticated centralization.

Re: Ruby core team takes ownership of RubyGems and Bundler

#390

Post by justinclift »

tptacek wrote: post #365
soraminazuki wrote: post #351

Earlier quoted context omitted.

The world doesn't line up with lies and spins of the most transparently corrupt actors either. Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash. Whe…

The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to q…

> We also know that (4) he attempted to quietly monetize the server logs from RubyGems.

What sort of monetisation?

Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(

Post reply on HN