About this, I noticed a relatively prominent gem maintainer publicly announcing his efforts to avoid rubygems security measures:
> I'll try to get a unicorn 7.x release soon but tests take
forever to run on ancient HW and I need to ration releases to
keep download counts low in order to stay under the MFA
threshold on Rubygems.org
> I don't ever want users viewing me as trustworthy nor liable for
anything I do, so no MFA nor sigs from me; just source + docs :>
If I understand correctly - the idea is that the unicorn maintainer does not want to be viewed as trustworthy and is avoiding MFA and signatures because they could build trust that isn't, in this case, wanted.
Good work to everybody involved. Looking into donating now.
Ruby/Rails and its ecosystem continues to prove itself the practical, boring, reliable workhorse option.
princevegeta89 · 1h ago
Boring? Not really.
My 2c: it is more enjoyable than the Js/Ts ecosystem we have today.
woodruffw · 28m ago
I think they meant boring in a positive way, as in "choose boring technology."
IFC_LLC · 1h ago
Interesting how the Internet turned into a place where you have to search for a long time in order to find something valuable. In this case - you have a dedicated team that sits there and diligently works on the quality of their product.
I should have turned to RoR 3 years ago.
infamouscow · 1h ago
Welcome to the ecosystem o/
burnt-resistor · 1h ago
But still lacks mandatory gem signing. I also wonder how many malicious gems were published prior to this.
firesteelrain · 1h ago
Even if it was mandatory, if it doesn’t get signed by a trusted CA then it is still self signed. RubyGems would have to reject all. But signing alone does not prevent malicious code
> I'll try to get a unicorn 7.x release soon but tests take forever to run on ancient HW and I need to ration releases to keep download counts low in order to stay under the MFA threshold on Rubygems.org
> I don't ever want users viewing me as trustworthy nor liable for anything I do, so no MFA nor sigs from me; just source + docs :>
If I understand correctly - the idea is that the unicorn maintainer does not want to be viewed as trustworthy and is avoiding MFA and signatures because they could build trust that isn't, in this case, wanted.
https://yhbt.net/unicorn-public/20231214230933.M299458@dcvr/
Ruby/Rails and its ecosystem continues to prove itself the practical, boring, reliable workhorse option.
My 2c: it is more enjoyable than the Js/Ts ecosystem we have today.
I should have turned to RoR 3 years ago.