ruby/rubygems on Hacker News

…more the longer it has been implemented as it only would be shared from versions going forward. [1] https://github.com/ruby/rubygems/issues/7249

comment by kimos · 2026-01-01 · in Can Bundler be as fast as uv?

Yup! It was deprecated on `rubygems` 3.0 and removed on `rubygems` 3.2 https://github.com/ruby/rubygems/blob/v3.1.6/lib/ubygems.rb https://github.com/ruby/rubygems/commit/8933115bff09402f6baa... https://github.com/ruby/rubygems/commit/7ac54…

comment by lloeki · 2025-11-10 · in Ruby already solved my problem

…require "rubygems/foo"' [0]: https://github.com/ruby/ruby/blob/v3_4_7/lib/bundler/bundler... [1]: https://github.com/ruby/rubygems/blob/v3.7.2/hide_lib_for_up...

comment by lloeki · 2025-11-08 · in Ruby already solved my problem

…configure flag. Back in 1.8 days, you even had to manually require `rubygems`! † https://github.com/ruby/rubygems/tree/4e4d2b32353c8ded870c14...

comment by lloeki · 2025-11-07 · in Ruby already solved my problem

…some of them should be addressed? Without maintenance, and any PR's getting merged, they won't. [0] https://github.com/rubygems/rubygems/issues

comment by mijoharas · 2025-10-07 · in Gem.coop

…answering myself on who rubymorillo was, it's someone who didn't commit in that gem since 2018: https://github.com/rubygems/rubygems/commits?author=rubymori... So yeah, permission management at Ruby Central did indeed seem to have been a…

comment by byroot · 2025-09-30 · in Our stewardship: Where we are, what's changing and how we'll engage

…went and checked the license under rubygems, and sure enough, it's standard MIT with no warranties. https://github.com/rubygems/rubygems/blob/master/LICENSE.txt

comment by bilalq · 2025-09-30 · in Our stewardship: Where we are, what's changing and how we'll engage

…healthy situation? [1] https://github.com/heroku/heroku-buildpack-ruby/pull/385/com... [2] https://github.com/rubygems/rubygems/issues/1811#issuecommen...

comment by hn8726 · 2025-09-28 · in Why I'm not rushing to take sides in the RubyGems fiasco

…over some responsibilities and/or on-call, see here for the sudden commits after a very long break: https://github.com/rubygems/rubygems/commits/master/?author=...

comment by tumdum_ · 2025-09-28 · in Why I'm not rushing to take sides in the RubyGems fiasco

…need to revoke that access without upsetting them? deivid-rodriguez's last commits were Sept 18: https://github.com/rubygems/rubygems/commits/master/?since=2... With 7873 commits since 2018 he's 2x over the second one and crushingly the…

comment by lloeki · 2025-09-22 · in A board member's perspective of the RubyGems controversy

She has some PRs merged in, but nothing that shows me she should have elevated rights in the repo. https://github.com/rubygems/rubygems/pulls?q=is%3Apr+author%...

comment by blasphemers · 2025-09-20 · in Ruby Central's Attack on RubyGems [pdf]

According to the author's PR where she removed herself as a maintainer, she lost commit access. https://github.com/rubygems/rubygems/pull/8987

comment by favorited · 2025-09-19 · in Ruby Central's Attack on RubyGems [pdf]

Who? Everyone I recognize is continuing to contribute. https://github.com/rubygems/rubygems/graphs/contributors?fro...

comment by sideofbacon · 2025-09-19 · in Ruby Central's Attack on RubyGems [pdf]

…bundler. You can see they had to vendor a lot of code from default gems to avoid this problem: https://github.com/rubygems/rubygems/tree/c230844f2eab31478f...

comment by byroot · 2025-08-27 · in Rv, a new kind of Ruby management tool

…multiple package managers such as this: mpm install script/https://get.rvm.io \ rvm/1.9.3 \ script/git@github.com/rubygems/rubygems/setup.rb \ gem/rails \ apt/mysql-server \ apt/mysql-client \ bundle/http://typosphere.org/stable.tgz…

comment by samsquire · 2023-04-14 · in Universal Install Script (2016)

…are. Specifically, locking versions is optional, there's no locking by hash (Github issue: https://github.com/rubygems/rubygems/issues/3379 ), and there's no capability to lock local or source-only dependencies by hash. By comparison: go…

comment by ievans · 2022-06-14 · in Making popular Ruby packages more secure

…has an install flag `--trust-policy` which can be used to verify various things, including certs ( https://github.com/rubygems/rubygems/blob/96e5cff3df491c4d94... ). The experience in using it, however, sucks on every level . No one can…

comment by halostatue · 2022-05-07 · in Unauthorized gem takeover for some gems

…news, I've also been following this PR to add Rust support to Ruby for gem native extensions: https://github.com/rubygems/rubygems/pull/5175 It seems to have hit a minor speedbump dealing with support for Windows.

comment by faitswulff · 2022-01-17 · in Ruby: Porting YJIT to Rust

The exponential version was also broken, just in a different way (cf https://github.com/rubygems/rubygems/pull/1191#issuecomment-... ).

comment by cygx · 2021-03-12 · in Drop millions of allocations by using a linked list (2015)

…running on TruffleRuby within Shopify according to Chris Seaton, Founder of TruffleRuby. [1] https://github.com/rubygems/rubygems/pull/2797#issuecomment-... [2] https://news.ycombinator.com/item?id=23182907

comment by ksec · 2020-05-19 · in TruffleRuby – GraalVM Community Edition 20.1.0

…have time and/or money and want to contribute to fixing this issue, please feel free to join in: https://github.com/rubygems/rubygems/issues/2496

comment by ioquatix · 2019-07-08 · in Strong_password Rubygem hijacked

…reproducible builds. Currently their issue with SOURCE_DATE_EPOCH is not yet supported properly. https://github.com/rubygems/rubygems/issues/2290 https://reproducible-builds.org/docs/source-date-epoch/

comment by Foxboron · 2019-04-04 · in Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem

…time, so arbitrary code can be executed at gem install time. AFAICS this is the relevant line: https://github.com/rubygems/rubygems/blob/master/lib/rubygem... Edit: Or, if you want to get a little more creative, have your gem include a…

comment by Xylakant · 2017-08-30 · in Multiple vulnerabilities in RubyGems

…actually both for the arbitrary file write issue, and there was a 5th commit for the ANSI issue: https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54... I went through all 4 issues and did a brief writeup for each of them. Only the…

comment by arkadiyt · 2017-08-30 · in Multiple vulnerabilities in RubyGems

I think these are the commits, but not all of them contain a detailed description. https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf... https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e...…

comment by kichik · 2017-08-30 · in Multiple vulnerabilities in RubyGems

Is the work on adding TUF to RubyGems still happening? I can only find this stagnant PR: https://github.com/rubygems/rubygems/pull/719

comment by jzelinskie · 2017-08-30 · in Multiple vulnerabilities in RubyGems

…this fixes a RCE that can be exploited by any MitM capable of poisoning a DNS response[1]. [1]: https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf...

comment by pfg · 2017-08-29 · in Multiple vulnerabilities in RubyGems

The Github PR for merging this into Rubygems is ~3 years old: https://github.com/rubygems/rubygems/pull/719

comment by cookrn · 2016-08-09 · in The Update Framework

…much? > Why exactly is Rubygems giving idiots access to it's source code? It's open source https://github.com/rubygems/rubygems all idiots have access to the source code, even you. I think the words you're looking for are "Thanks for…

comment by schneems · 2016-03-07 · in How Changing WebFonts Made Rubygems.org 10x Faster

…used elsewhere in the program. This only fixes a couple of bugs using that same mechanism. https://github.com/rubygems/rubygems/blob/800f2e63bc6174b5b4...

comment by randomdata · 2015-03-13 · in Drop millions of allocations by using a linked list

…it's worth, --trust-policy has been broken since RubyGems 2.0.0 and will not be fixed until 2.3: https://github.com/rubygems/rubygems/issues/859

comment by InAnEmergency · 2014-04-30 · in Ruby Security Have You Not

btw the packages include a patch for a bug in rubygems 2.2.0 ( https://github.com/rubygems/rubygems/issues/766 ). Other than that, they're stock upstream versions.

comment by jeremyjarvis · 2014-01-09 · in New Ruby 2.1 Ubuntu Packages

Or, for a more apt (heh) comparison: https://github.com/rubygems/rubygems

comment by knappe · 2013-10-22 · in Explicit bootstrapping of pip in Python installations

…a massively central system that is widely trusted with no means of code verification whatsoever. https://github.com/rubygems/rubygems/blob/master/History.txt 0.8.11 / 2005-07-13: Added Paul Duncan's gem signing patch. They've had a…

comment by ceejayoz · 2013-01-31 · in Chinese Hackers Infiltrate New York Times Computers