From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Giving up on RubyGems Date: Tue, 20 Oct 2015 15:19:10 -0400 Message-ID: <20151020191910.GA19646@jasmine> References: <87eggpya7p.fsf@izanagi.i-did-not-set--mail-host-address--so-tickle-me> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55236) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZocRJ-0004IJ-Oe for guix-devel@gnu.org; Tue, 20 Oct 2015 15:19:18 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZocRG-0004to-KI for guix-devel@gnu.org; Tue, 20 Oct 2015 15:19:17 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:54225) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZocRG-0004tL-F0 for guix-devel@gnu.org; Tue, 20 Oct 2015 15:19:14 -0400 Content-Disposition: inline In-Reply-To: <87eggpya7p.fsf@izanagi.i-did-not-set--mail-host-address--so-tickle-me> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: David Thompson Cc: guix-devel@gnu.org On Tue, Oct 20, 2015 at 08:51:22AM -0400, David Thompson wrote: > I've grown very tired of trying to convince people that independent user > verification of binary releases is an important thing to prioritize, but > they think that users do not want the source code. I've tried to make > my arguments as clear as I could, yet they've been misunderstood by some > and rejected entirely by others, and now it is time to give up. As someone with zero Ruby experience, I find this very confusing. Are you saying that they don't think it's necessary to be able to build the Gem "binaries" independently? If that were true, how can RubyGems be a trusted intermediary between software authors and users? How can users verify that the RubyGems people are not distributing malicious "binaries". Am I totally misunderstanding the role of RubyGems in the Ruby world? > This effort has drained too much of my enthusiasm, and now I need a > break. :( We all have experiences like this once in a while. Everyone appreciates the work you do on Guix. Hopefully you can come back with some fresh energy when you are ready!