Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm leaving Ruby Central

gist.github.com

Post reply on HN
Print view View original

91–100 of 134 posts

Re: I'm leaving Ruby Central

#91

Post by notatallshaw »

nenenejej wrote: post #48

The solution is to design package managers around the uniform resource identifier: a way to locate online assets that is mostly (ignoring DNS) decentralised and better than having one org own all the packages.

Taking PyPI as a central place of packages, it is known that their bandwidth bill would be $1.8+M per month (https://dustingram.com/articles/2021/04/14/powering-the-pyth...) were it not for Fastly giving them a 100% discount.

Are there any reliable decentralized package distribution systems operating at within 2 orders of magnitude of that scale? How do they handle administrative issues such as malicious packages or name squatting? Standards updates? Enforcement of correct metadata? And all the other common things package indexes need to handle.

I'm clearly skeptical, but would be very interested in any real world success stories.

Re: I'm leaving Ruby Central

#92

Post by cortesoft »

tuyosvawnt wrote: post #25

it was never clear what the niche of Ruby was other than being a modernish scripting language for non-critical web dev. I remember Ruby on Rails becoming trendy for web startups with inexperienced programmers (I was one of them) to prototype things in because Active Record was a simple ORM for its time, outside of that there wasn't much other justification for the stack and since the proliferation of similar easy-to-…

Ruby has been my favorite programming language by far for 20 years now. The design decisions just make sense to me, and it is always fun to write.

It really occupies the same niche that Python does, but personally I find ruby more pleasant to work with in every way.

Re: I'm leaving Ruby Central

#93

Post by kmacdough »

torben-friis wrote: post #28
jaredcwhite wrote: post #19

Earlier quoted context omitted.

In a word, yes.

What I don’t get is, what does Shopify get from this? I’m assuming there’s a ton of reputational risk in this move, and my understanding as an outsider is that Shopify already has a ton of weight in the Ruby ecosystem - they seem to be the one case quoted by everyone as the “proof that Ruby scales”.

I suspect they underestimated the lashback. They wanted to make their changes whenever they wanted, to fit their specific needs. They didn't think twice about the community, so much so that they didn't consider the community might not stand for it.

And history ain't written. Who knows how this will hurt them.

Re: I'm leaving Ruby Central

#95

Post by fencepost »

As a complete outsider I mostly find myself wondering if there's legal recourse for those who were forced out (noting the clear distinction that one person was commenting on between the service owned by Ruby Central and the code that Ruby Central likely has no legal claim to).

Re: I'm leaving Ruby Central

#96

Post by kenhwang »

hiharryhere wrote: post #50
flkiwi wrote: post #39

Earlier quoted context omitted.

There are arguably larger reputational risk issues in a company with significant financial/payment activities not having adequate control of their technology. I'm not saying that justifies anything here as I don't know nearly enough about, but I'd wager that even a minor incident arising from them not adequately controlling their stack would create infinitely more issues than this move.

If supply chain integrity is the issue specifically for Shopify, couldn’t they run their own private, internally facing gem repository and whitelist everything that goes there? It’s not a requirement to use the public rubygems.

They probably thought it would be easier to takeover rubygems than ensure every dev and every machine for every possible ruby tool could be and is pointed at the internal gem repository.

Let's be paranoid for a moment. What if there's a supply side attack on a gem used by Homebrew. That's basically installed on every dev machine, auto-updates automatically/silently, could have sudo, that no one would care or even know how to point at a private gem repository.

Re: I'm leaving Ruby Central

#97

Post by Forgeties79 »

viccis wrote: post #85
Forgeties79 wrote: post #60

Earlier quoted context omitted.

Yeah I use em dashes probably every day. It’s only recently that people have started taking issue with it lol

I used to think people here didn't really use them before AI, but I actually downloaded a dataset of all comments over like a decade or so and counted the number of comments with an em dash, and it didn't actually change much around 2022-2023 like I had expected. It's the spacing that's usually the giveaway to me, as well as the fact that it's not as common for people to use them like semicolons. They use them for pa…

I have a very conversational way of writing partially because I do voice to text a lot, so the em dash just “feels” better to me than a semicolon typically.

Re: I'm leaving Ruby Central

#98

Post by hiharryhere »

hosh wrote: post #59
nenenejej wrote: post #48

The solution is to design package managers around the uniform resource identifier: a way to locate online assets that is mostly (ignoring DNS) decentralised and better than having one org own all the packages.

That sounds like a neat idea. Do you have a proposal for that? Would it be compatible with specifying urls (such as git repos)?

Bundler already does this.

  # From a specific branch
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', branch: 'development'

  # From a specific tag
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', tag: 'v1.2.3'

  # From a specific commit (ref)
  gem 'my_gem', git: 'https://github.com/user/my_gem.git', ref: 'a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0'

Re: I'm leaving Ruby Central

#99

Post by yakshaving_jgt »

kenhwang wrote: post #96
hiharryhere wrote: post #50

Earlier quoted context omitted.

If supply chain integrity is the issue specifically for Shopify, couldn’t they run their own private, internally facing gem repository and whitelist everything that goes there? It’s not a requirement to use the public rubygems.

They probably thought it would be easier to takeover rubygems than ensure every dev and every machine for every possible ruby tool could be and is pointed at the internal gem repository. Let's be paranoid for a moment. What if there's a supply side attack on a gem used by Homebrew. That's basically installed on every dev machine, auto-updates automatically/silently, could have sudo, that no one would care or even kno…

It was my understanding that they wanted to use Nix to solve this problem.

Re: I'm leaving Ruby Central

#100

Post by rmoriz »

jcmfernandes wrote: post #88
rmoriz wrote: post #37

Ruby Central should have been more involved in the development of rubygems (software) in the past and establish a community and contribution guideline, to secure the project, secure funding, maybe separating concerns (infrastructure, conferences, etc.) However, taking away funding as retaliation for a conference talk is offensive, too. In the end facts (money) made the decision. I don't think Shopify has bad intentio…

An individual decided to stop donating 250k to an organization because he felt strongly about actions taken by the organization. How is this offensive?

To my knowledge: Sidekiq is the lead project of Contributed Systems LLC. Ruby Central also announced to end the "RailsConf" series after this year.

I fully understand and support to be angry about and cut all ties to the 3-letter-guy, but I think this Ruby Central/Rubygems issue is a case of "friendly fire".

Post reply on HN