With a Little Help from My Friends
summary
Libraries.io and rubygems data show 52 gems per app, 46% of gems untouched for 3+ years, 30% without a license, 90% bus factor of 1, average owners 1.2, and every gem carries potential arbitrary‑code execution at install. 80% of downloads go to 160 gems maintained by 262 people. Proposal: give maintainers anonymized install, exception and performance telemetry (reach out to RubyGems, BugSnag, Skylight/NewRelic). Built a proof‑of‑concept npm postinstall tracker (Google Analytics) that collected ~500k installs to demonstrate feasibility.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:42Hello!
- 1:10Andrew Nesbitt
- 2:21Can my friends come too? Brighton Ruby 2017
- 4:33$ gem install arbitrary code execution via extconf.rb
- 6:59Lack of License?
- 7:17Need a new release pushing?
- 7:40Adding more maintainers to a project?
- 8:2980/20
- 9:23144,000 Gems
- 12:07We're not just standing on the shoulders of giants
- 13:29HOLD ON
- 14:29Give them money?
- 15:18Switch to Rust?
- 15:30Free Time?
- 16:11Maintainers are working mostly in the dark
- 16:54Every change Breaking change
- 18:06What can we do for maintainers?
- 20:25I'd like to propose...
- 27:07I found a bug!
- 27:27Windows!
