You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes.
Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things be fixed within the Ruby community? Yes.
So if you want to advocate that people shouldn't use Ruby or Rails, fine, your prerogative. But please, stop being an asshole while doing it.
Will they do the responsible thing and throw out all of the existing, poorly-written code?
Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start?
Will they throw out their flawed development philosophies, so that they don't get into the same situation later on?
I'm unfortunately inclined to think that we'll just see more of the same. These problems will be "patched" over, at best, rather than fixed at the root. In fact, proper fixing of these issues would go against everything that the Ruby community stands for.
That's why I think that moving away from Ruby and Ruby on Rails is a responsible approach. Some problems just can't be fixed, and I think we've encountered some of those in this situation.
Many of us Ruby-users see the problems in a similar way and try to fix them. It's a learning process and it happens right now. The ruby community is also not an uniform blob. We are not 37signals and we are not the rubygems team. Many of us disagree with some decisions made at these places. Most of us also use other languages and are well aware of the trade-offs that Ruby implies.
This is all worth discussing and the specific problems are worth fixing. The rubygems-team happens to be working on their problem, which is a hard problem, right now; https://gist.github.com/4696144
Your mindless bashing on every Ruby HN-thread contributes nothing. Please use your time for something more productive, e.g. you could go to your preferred language community and help them fix their security problems, which they also have plenty of.
http://www.cvedetails.com/product/22569/Rubyonrails-Rails.ht...
http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...
There is one critical difference between OS package repos and the programming language repos: For an OS package repo, signing is mandatory. Programming language repos allow that, but don't enforce it. Python is a little ahead here, but this is nothing that can't be fixed. I actually see that gem signing will be mandatory in the foreseeable future.
Regardless of the merits of a discussion regarding security, open source software, and the ruby community, it's clear that you have an axe to grind, and are not participating in this conversation in a constructive manner.
There is no point in engaging you in a discussion about Ruby security, because you just want people to stop using Ruby. Again, that's your prerogative, but don't try to dress it up as your overwhelming concern for security.
The practical matter is that folks are going to continue using Ruby with 100% certainty for the short term.
So if you were actually interested in security, rather than trolling or gloating, you could actually comment on the technical matters under discussion, instead of just telling people "stop using ruby" and that the "proper fixing of these issues would go against everything that the Ruby community stands for."
The Ruby community may come out of this better and stronger but it's quite valid to suggest that some people may be better off moving on.
You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes.
His generalizations fit well enough to include the dev teams of the core package management system and the by-far predominant application framework. As broad generalizations go that's a pretty effective reach.
Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah.
Yeah.
Do things need to be fixed? Yes.
Yes.
Can these things be fixed within the Ruby community? Yes.
Woah, hold your horses there. Can they be fixed within a Ruby community? Yes. Can they be fixed within the community as it now stands, with its present culture and practices? I would hesitate before answering yes.
But please, stop being an asshole while doing it.
Turned out Walter was right, in the end. She did kidnap herself.
I don't begrudge people being right (although, I also don't happen to think that Mr. Potato there is totally correct). I do however have a problem with people being jerks.
Moreover, being right does not give someone license to be a jerk either.
-----------------------------
As for the substance, yeah I do think there are ways to secure Ruby gems better, and I think that given the way the Ruby community is organized (since it's not a monolith), there are paths forward that can be organized and implemented by smart and interested rubyists, and those paths can and will be adopted by the bulk of developers who aren't as engaged in the Ruby ecosystem.
