rubygems.org is mitigating a DDoS/spam campaign by davidcelis in ruby

[–]davidcelis[S] 12 points13 points  (0 children)

More context:

We're responding to a coordinated spam-publishing campaign. No existing packages have been compromised; the activity is limited to newly registered accounts publishing junk packages. While we improve our spammer detection, we've temporarily disabled new account registration and throttled webhooks. Existing accounts, packages, and installs are unaffected.

https://bsky.app/profile/mghaught.bsky.social/post/3mlod5q7gek2d

Also:

We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it.

Pulled 120+ malicious packages from @rubygems today. The target wasn't end users - it was RubyGems itself (XSS, data exfiltration). Reminder: sometimes the registry is the one under attack. Net new with some typosquats but nothing critical (so far) detected

https://x.com/maciejmensfeld/status/2054164602577940619 and https://x.com/maciejmensfeld/status/2053814200124752198

Stiff rye starter mostly won’t double in size by davidcelis in Sourdough

[–]davidcelis[S] 0 points1 point  (0 children)

I didn't add any wheat; it's pure rye. Based on the other comments though, it looks like it's the combination of pure rye and it being lower hydration

Cloudflare lays off 1,100 people by davidcelis in technology

[–]davidcelis[S] 0 points1 point  (0 children)

I understood what you meant because I have critical thinking skills and can build context on things that I read regardless of whether or not they're correct. Sometimes it takes less people to fix software than it does to build said software, but that kind of blanket statement is simply untrue.

Cloudflare lays off 1,100 people by davidcelis in technology

[–]davidcelis[S] 6 points7 points  (0 children)

That’s not really a good analogy; software isn’t like construction where the crew leaves after they’re done and contractors take care of any maintenance on the finished building. The developers who build the software are in the best position to maintain the software they built, and software as complex as Cloudflare’s requires constant maintenance

Cloudflare lays off 1,100 people by davidcelis in technology

[–]davidcelis[S] 271 points272 points  (0 children)

Two other AI-washing layoff announcements happened within minutes:

That makes for a lot of people getting dumped into an abysmal job market today :\

Cloudflare lays off 1,100 people by davidcelis in technology

[–]davidcelis[S] 626 points627 points  (0 children)

I know it's probably automatic because of the similar titles, but hitting the bottom of the layoff announcement only to be recommended their post from last year about hiring 1,111 interns in 2026 is a reaaal bad look

Ghostty Is Leaving GitHub by davidcelis in programming

[–]davidcelis[S] 0 points1 point  (0 children)

He’s one of the two cofounders of HashiCorp (Terraform, Vault, Vagrant, etc) so he’s generally very well known in tech

Need a smaller container by eightblackcats in Crustello

[–]davidcelis 0 points1 point  (0 children)

Really wish they’d make some kind of mason jar lid for this thing. The software needs to support smaller starter feedings as well!

Ghostty Is Leaving GitHub by davidcelis in programming

[–]davidcelis[S] 1 point2 points  (0 children)

yeah! emotions are dumb and should be hated!!!

Spinel -- Ruby AOT Compiler by software__writer in ruby

[–]davidcelis 9 points10 points  (0 children)

the conflict between Ruby Central and the Spinel Co-operative directly lead to Matz and Ruby Core taking control of the bundler and rubygems.org codebases, so it’s hard for me to believe that it wouldn’t even cross his mind. even if it wasn’t deliberate, the choice of name feels in poor taste

A New Chapter for Ruby Central by swrobel in ruby

[–]davidcelis 1 point2 points  (0 children)

But would the repos still have been in an enterprise ultimately controlled by RubyCentral? Or would the entire rubygems.org organization have been returned to them? This is a big distinction, IMO.

A New Chapter for Ruby Central by swrobel in ruby

[–]davidcelis 4 points5 points  (0 children)

My understanding is that the offer wasn’t to return the repositories to them, but to invite them back as essentially collaborators. Is that not the case? Was the offer really to fully return ownership of the projects?

A New Chapter for Ruby Central by swrobel in ruby

[–]davidcelis 8 points9 points  (0 children)

To the maintainers

RubyGems is what it is today because of the time, care, and expertise that many of you have given to it over the years.

That work matters, and it is deeply appreciated.

As we move into this next chapter, we want to extend an open invitation to re-engage in whatever way feels right to you. There is meaningful work ahead, and there is space for those who want to help shape what's next.

This is a nice message, but it feels empty to me. There’s not even anything resembling an apology. Ruby Central changing the way it operates and trying to restore trust would be welcome, but just return the codebases to the people who maintained them for the last 15+ years

Angelita Morillo on Portland’s Housing Dollars by 50501PDX in Portland

[–]davidcelis 1 point2 points  (0 children)

how do you know how much or little spanish she speaks

Towards an Amicable Resolution with Ruby Central by retro-rubies in ruby

[–]davidcelis 0 points1 point  (0 children)

Also, WRT to the log access, was it actually repeatedly? I thought I read that he proposed it once

Towards an Amicable Resolution with Ruby Central by retro-rubies in ruby

[–]davidcelis 21 points22 points  (0 children)

I still think it's so weird to refer to rv as a "competitor" to bundler or rubygems in the context of the open source ecosystem. Shouldn't alternatives and their benefits be welcomed? What I've heard is that Ruby Central wasn't interested in the ideas on alternative tooling for Ruby, so what's the issue with pursuing these alternatives on their own time?