Hacker News Reader

Comment by mosura | Hacker News Reader

What I don’t get is if there is one actor in the Ruby ecosystem that absolutely needs it all to be run in a responsible way it is Shopify, so quite why so many people are concerned about some mysterious back room dealing by Shopify is beyond me. They are not Oracle.

View on HN

For me, most people that are involved (e.g. simi, a, now former, maintainer[0]) seem to point to this post by Joel drapper as a canonical and accurate accounting of events, and I have no reason to doubt them[1]. Most of the article says it's due to pressure from Shopify.

[0] https://gist.github.com/simi/349d881d16d3d86947945615a47c60c...

[1] https://joel.drapper.me/p/rubygems-takeover/

Sorry I didn’t mean to express doubt they are behind this. What I don’t understand is why the community are so freaked out by this given the incentives are very much for Shopify to ensure it operates properly.

Got it, makes sense, and I agree (and am also kinda confused).

Their behavior is at odds with that sentiment, though.

I suspect it's because DHH is on the board of Shopify [1] and a lot of people really don't like him [2].

(To be clear, I am not stating my own opinion of DHH or Shopify. I'm just saying I suspect this is why a lot of Rubyists are not OK with RubyCentral being under the thumb of Shopify.)

[1]: https://www.shopify.com/news/david-heinemeier-hansson-board

[2]: https://davidcel.is/articles/rails-needs-new-governance

Shopify has plenty of resources to run their own internal, ultra secure Rubygems mirror.

With no insider knowledge whatsoever I can assure you that they do. Large enterprise shops always have these things cached because why take a hard deploy-time external dependency when you can spin up a rubygems (etc) cache backed entirely by your object storage of choice.

Former Shopifolk here. As of 2022 - 2023 they had some private packages in their SCM and an internal Artifactory deployment that was a caching proxy of Rubygems and other upstream dependencies. This may be changed since, but as far as I’m aware many Shopify devs occasionally volunteer time and fixes to Rubygems and related projects from time to time.

They certainly have the capacity to run their own full on mirror service, but I doubt they have serious incentive to do so given exciting controls and culture re: Ruby and OSS contributions.

There is no way. Shopify is trying to be part of the Ruby community, because it knows if it becomes the community or bypasses the community, then the community are dead.

I think what is most likely is that Shopify is trying to achieve some security goals in rubygems through Ruby Central. That they put a deadline on funding based on some security guarantees.

Shopify knows they are a high value target. I bet they thought they could muscle for whatever they want using funding money, and didn’t anticipate the mishandling and then blowback.

Being a part of the community necessitates that there be a community to be part of. Taking unilateral control is not being part of a community.

Sometimes organisations that are given near veto power over a Community Thing will bend that Thing to be self serving of themselves.

Red Hat -> IBM -> CentOS is an example of this to me.

Reply on news.ycombinator.com