6 ms·

About this, I noticed a relatively prominent gem maintainer publicly announcing his efforts to avoid rubygems security measures: > I'll try to get a unicorn 7.

About this, I noticed a relatively prominent gem maintainer publicly announcing his efforts to avoid rubygems security measures: > I'll try to get a unicorn 7.x release soon but tests take forever to run on ancient HW and I need to ration releases to keep download counts low in order to stay under the MFA threshold on Rubygems.org > I don't ever want users viewing me as trustworthy nor liable for anything I do, so no MFA nor sigs from me; just source + docs :> If I understand correctly - the idea is that the unicorn maintainer does not want to be viewed as trustworthy and is avoiding MFA and signatures because they could build trust that isn't, in this case, wanted. https://yhbt.net/unicorn-public/20231214230933.M299458@dcvr/ https://yhbt.net/unicorn-public/20231214230933.M299458@dcvr/

Lammy 1y ago
[flagged]
- paulryanrogers 1y ago
  So the solution is none? Not better MFA tools?
  - mcny 1y ago
    I hate Microsoft's approach which puts its own MFA app as somehow better than standard TOTP. I want to use standard apps like authy or aegis or even apple passwords app which doesn't require my phone to be connected to the Internet. I sincerely do not agree with their premise at all. Coming back to OP, better MFA tools and allowing people to NOT display the verified checkmark should solve the issue? At least talk to the person and hear their grievances.
    - halostatue 1y ago
      As noted, the maintainer is eccentric. They will not do anything that requires JavaScript.
drzaiusx11 1y ago
From the unicorn readme: "unicorn is an HTTP server for Rack applications that has done decades of damage to the entire Ruby ecosystem due to its ability to tolerate (and thus encourage) bad code." Might have something to do with it.
jrochkind1 1y ago
I feel like the unicorn maintainer(s) have been trying to kill unicorn for a while, making decisions meant to be user-hostile. I'm not sure why they are maintaining it at all.
- halostatue 1y ago
  It would be better if he did kill it.
  - cortesoft 1y ago
    Ironically, my main memory from back when I used unicorn was that the supported way to stop the server was to run "killall unicorns"
halostatue 1y ago
The maintainer is eccentric. He refuses to use anything that runs JavaScript out of a sense of "Free Software Purity", which means that he cannot use most of the ecosystem to which Ruby has migrated. He has only contributed to Ruby via the ruby-core mailing list (he does not use the RubyMine interface which backs ruby-core) and the main Ruby git repo hosted by the Ruby team, never anything on GitHub. I'm sort of surprised that the RubyGems MFA threshold hasn't been updated (it was 180M total downloads in 2022; my gems combined have > 2.5B downloads, so I was never not going to pass the threshold), but he's under 70M downloads shy and each release gets about 15M downloads or so. I think that his position is irresponsible in today's threat environment, but given the amount of work that I'm doing for OSS maintenance that's just responding to bloody Dependabot updates…
- haute_cuisine 1y ago
  It would be nice if OSS maintainers would start charging for extra security features like signed releases at least $1k/y per project.

Lammy 1y ago

[flagged]

paulryanrogers 1y ago
So the solution is none? Not better MFA tools?
- mcny 1y ago
  I hate Microsoft's approach which puts its own MFA app as somehow better than standard TOTP. I want to use standard apps like authy or aegis or even apple passwords app which doesn't require my phone to be connected to the Internet. I sincerely do not agree with their premise at all. Coming back to OP, better MFA tools and allowing people to NOT display the verified checkmark should solve the issue? At least talk to the person and hear their grievances.
  - halostatue 1y ago
    As noted, the maintainer is eccentric. They will not do anything that requires JavaScript.

drzaiusx11 1y ago

From the unicorn readme: "unicorn is an HTTP server for Rack applications that has done decades of damage to the entire Ruby ecosystem due to its ability to tolerate (and thus encourage) bad code." Might have something to do with it.

jrochkind1 1y ago

I feel like the unicorn maintainer(s) have been trying to kill unicorn for a while, making decisions meant to be user-hostile. I'm not sure why they are maintaining it at all.

halostatue 1y ago
It would be better if he did kill it.
- cortesoft 1y ago
  Ironically, my main memory from back when I used unicorn was that the supported way to stop the server was to run "killall unicorns"

halostatue 1y ago

The maintainer is eccentric. He refuses to use anything that runs JavaScript out of a sense of "Free Software Purity", which means that he cannot use most of the ecosystem to which Ruby has migrated. He has only contributed to Ruby via the ruby-core mailing list (he does not use the RubyMine interface which backs ruby-core) and the main Ruby git repo hosted by the Ruby team, never anything on GitHub. I'm sort of surprised that the RubyGems MFA threshold hasn't been updated (it was 180M total downloads in 2022; my gems combined have > 2.5B downloads, so I was never not going to pass the threshold), but he's under 70M downloads shy and each release gets about 15M downloads or so. I think that his position is irresponsible in today's threat environment, but given the amount of work that I'm doing for OSS maintenance that's just responding to bloody Dependabot updates…

haute_cuisine 1y ago
It would be nice if OSS maintainers would start charging for extra security features like signed releases at least $1k/y per project.