HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rubygems
rubygems.org
Ruby2013–2025
rubygems / rubygems.org

rubygems.org

The Ruby community's gem hosting service.

Developer Tools
Explore on GitHubRead Hacker News discussions
19Distinct people
21Mentions
1Explicit recommenders
2.4KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The Ruby community's gem hosting service.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

If anyone is looking to do some open source contributions on a mature, production Ruby on Rails site, I highly recommend contributing to the rubygems.org project. The code is…

bradly used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year21 dated mentions

Observed mentions: 2013-01-31 16:31:38 UTC to 2025-09-20 00:26:22 UTC.

02468102013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20132014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 10 mentions; 2 submissions, 8 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC202
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC000
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC000
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC202
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC1028
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101

What Hacker News says

21 sources
k33n·Sep 20, 2025
The idea that Ruby Central is "attacking" its own project -- that it has secured funding for -- for a decade plus, is not really based in reality. Not sure what goes on in their "Github Enterprise", but their vanilla github is pretty transparent. Marty has been doing good work in the repo as of late around the Orgs feature. I rely on rubygems.org, and my fork of rubygems.org on a daily basis. The project is an objective public-good. It's sad that a former employee is attempting to burn it all down. I guess they thought it was all about them and not the millions of DAU's the platform has served without fail since inception. Contractors will come and go. What are the OPs contributions even? I don't see a single commit from her handle on the 24 month view (below). Correct me if I'm wrong. https://github.com/rubygems/rubygems.org/graphs/contr
Read the rest
ibutors...
In Ruby Central's Attack on RubyGems [pdf]
jacques_chester·Aug 16, 2022
For RubyGems: 1. You get given recovery codes when you enable MFA. Each is a single-use code that stands in for an OTP code. If you kept them, you can use these to login and then change your device. 2. If you lost those too, there's a manual reset process. As you can imagine it's slow and requires careful scrutiny to guard against social engineering attacks on the rubygems.org maintainers. In future it will be possible to use WebAuthn[0] for rubygems.org and, ideally, you will be able to bind multiple hardware tokens or biometric devices to your account, so that you have backup options. [0] https://github.com/rubygems/rubygems.org/pull/2865
In Requiring MFA on popular gem maintainers
jacques_chester·Jun 14, 2022
RubyGems does have gem signing, but it's not widely used. There's a proposal for a new "one button" approach using sigstore[0]. Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway. Disclosure: I am involved with both of these. [0] https://github.com/rubygems/rubygems.org/pull/2944 [1] https://github.com/ossf/wg-securing-software-repos
In Making popular Ruby packages more secure
semiquaver·May 8, 2022
SSH is such a different use case that the analogies break down. With respect, thinking about this for a few minutes should convince you that while TOFU works fine for immutable artifact signatures, it is unworkable for a system where you ever upgrade packages. Consider that most nontrivial projects on rubygems have multiple maintainers that can publish a version. Normal collaboration models would imply that they each have a personal signing key; sharing a single signing key per project isn’t realistic (as you mentioned, rotation is another reason for this). And TOFU doesn’t work when there are multiple possible keys, such a system requires an external trust chain. Assume for the sake of argument the above is solved. What exactly do you do when tooling alerts you that an upgraded dependency has changed keys since the last version? Eithe
Read the rest
r you blindly accept the new key or you investigate. If the latter hopefully you have a way to directly contact the author to verify that the rotation was legitimate. Since you probably don’t you should just compare the diff of the published artifacts. But you should have been doing this anyway, so what has the signature bought you here except false security? Imagine a system like npm, where hundreds of transitive dependencies are upgraded all the time. Would you really want a key change in a 3rd-level dep you didn’t even know you were using to block you from installing a security fix to a primary dependency until you could somehow vet the new key? Such a system would change very quickly to Trust On First Use But Also Trust On Any Change… I’m all for pragmatic solutions that measurably improve supply chain security. I just think changes like https://github.com/rubygems/rubygems.org/pull/2499 and https://github.com/rubygems/rubygems.org/pull/2242 which recognize the social aspect of the problem qualify to a much greater extent than thinking of crypto as magic dust that can be sprinkled on a system to increase its security.
In Unauthorized gem takeover for some gems
dorianmariefr·Mar 5, 2022
See https://github.com/rubygems/rubygems.org/pull/2865 for the web part > From the replies it sounds like this is talking about client software? Yes the command line is a client to the rubygems server > An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step You either need a PIN, a fingerprint, a press, or no action just owning the device or the software. > if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob. If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think > OpenSSH works with Yubikeys Nice, I will look into it
In Ask HN: How many 2FA tokens do you have?

Showing the 15 most recent of 21 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.