Lightnews — Scholar-powered news

Reposted by Martin Emde

puppy @duckinator.bsky.social · 16h

On RubyGems & Governance: pup-e.com/blog/on-ruby...

Many programmers have no interest in formal governance processes, but letting people act and speak on our behalf without our input is what got us here.

The path forward is for the community to speak up and take direct ownership of what we make.

On RubyGems & Governance

pup-e.com

2 7 13

Martin Emde @martinemde.com · 15h

Join the bundler slack and message me, that’s probably best? Or dm me here.

2

Martin Emde @martinemde.com · 21h

Trust chains are interesting. Time for key signing parties at conferences? (only half joking) a purist would probably object, but if everyone can put their trust in the certificate authority for everything else, we probably can too. Eggs, meet your basket.

1

Reposted by Martin Emde

JP Camara @jpcamara.com · 1d

We never needed while loops. The power was always within us.

5 7 23

Martin Emde @martinemde.com · 1d

You can read more from one of the security experts keeping the Ruby community safe.

mensfeld.pl/2025/01/the-...

Bundler 2.6: Enhanced Security with Built-in Checksum Verification

Protect your Ruby projects from supply chain attacks with Bundler 2.6's new checksum verification. Learn how to implement this crucial security feature today.

mensfeld.pl

2 3 8

Martin Emde @martinemde.com · 1d

Now’s a good time to add CHECKSUMS to your Gemfile.lock. For an existing project:

bundle lock --add-checksums

This will add a new CHECKSUMS section to the lockfile that Bundler will keep up to date.

Now, configure Bundler to always include checksums:

bundle config lockfile_checksums true

1 4 15

Reposted by Martin Emde

Kewe Emde @kewe.me · 1d

I interrupted a family meeting of quail in my yard. It’s their yard now.

1 1

Reposted by Martin Emde

blood-starved jules @julesprom.bsky.social · 3d

“when you make an embaressing unforced error, make a bunch of additional unforced errors to confuse your enemy” - Sun Tzu

1 13 83

Reposted by Martin Emde

André Arko @indirect.io · 3d

announcing a new community-focused gem server from the team previously behind rubygems: gem.coop. join us and start using it today!

15 130 280

Reposted by Martin Emde

puppy @duckinator.bsky.social · 3d

The team formerly behind RubyGems has come together to launch a new gem server for the Ruby community!

gem.coop

I am *super* excited about this!

gem.coop

3 56 160

Martin Emde @martinemde.com · 3d

I wrote a little about it on my site. martinemde.com/2025/10/05/a...

I can't wait to make more chicken puns with you all.

Announcing The Gem Cooperative - Martin Emde

martinemde.com

1 4 14

Martin Emde @martinemde.com · 3d

I'm excited to join my friends in announcing gem.coop, a new ruby community gem server that you can use right now.

gem.coop

1 10 36

Martin Emde @martinemde.com · 5d

Ok, yeah we use md5 to avoid name collisions when two names only differ by case on case insensitive file systems. Not a security flaw, just an annoyance for FIPS github.com/rubygems/gem...

GEMSTASH-194 Support for FIPS Mode by ayohrling · Pull Request #195 · rubygems/gemstash

This updates the digest usage from MD5 to SHA256 to support hosts that are configured in FIPS mode. Fixes #194

github.com

2

Martin Emde @martinemde.com · 5d

Oops, NathanZook (my phone insists on typing Zoom)

1

Martin Emde @martinemde.com · 5d

I forget what part of gemstash uses MD5. We needed more contributions there. NathanZoom was helping organize the work here: github.com/rubygems/gem...

1

Martin Emde @martinemde.com · 5d

Hmm, I’m not sure what you mean. Rubygems.org definitely had working MFA both for login and gem pushes.

1

Martin Emde @martinemde.com · 5d

Yep, when was directing OSS at Ruby Central I tracked down any remaining outside contributors that didn’t have MFA and either removed them or had them enable MFA, then enabled this myself. That was between 1 and 2 years ago (hard to remember exactly)

5

Martin Emde @martinemde.com · 5d

My GitHub settings had a little note (from memory) “because of your contributions on GitHub, you must have strong MFA enabled. Thank you for keeping the ecosystem secure.”

1 2

Martin Emde @martinemde.com · 5d

It bothers me that Ruby Central keeps implying that maintainers didn’t have MFA enabled. This is preposterous. MFA is basic good practice. (Go enable it everywhere!)

It is literally impossible to disabled MFA because GitHub identifies rubygems as critical infrastructure. They know this.

2 1 9

Martin Emde @martinemde.com · 5d

Oh, not for ruby 3.3.6 yet. Maybe if _somebody_ hadn’t been so distracting for the last couple weeks. 😆

1 2

Martin Emde @martinemde.com · 5d

The `rv` in the brew is free. You can just use it.

1

Reposted by Martin Emde

Kewe Emde @kewe.me · 5d

Putting together my companion app for Tales of the Shire has suddenly made me question the existence of all the meat meals in the game. It implies there is an adorable, cozy, little hobbit slaughterhouse. Is it candle-lit?

1 1 1

Martin Emde @martinemde.com · 6d

Yep, from the outside it was a complicated black box, but then when reviewing you realize "of course, we can just bail early for a lot of these since a low distance is impossible."

I think we also stopped checking when the word was so short that every other short gem matched. Fun times

Martin Emde @martinemde.com · 7d

I literally can’t remember which way it goes.

Thankfully, Levenshtein distance to the rescue so I don’t get pwned. (Our friend @duckinator.bsky.social just recently vastly improved the speed of that algorithm so not found gems don’t take forever to offer suggestions.)

NatorGoat (@nator.bsky.social)

@sklifos.bsky.social is my one and only partner.

nator.bsky.social

1 1

Martin Emde @martinemde.com · 7d

Proper ruby capitalization requires that the file then be named ruby_gems.rb but that’s not the name!

@fxn.bsky.social knows this! 😂 Good thing rubygems is loaded before zeitwerk.

1 2