Robert
fnordfish.ruby.social.ap.brid.gy
Robert
@fnordfish.ruby.social.ap.brid.gy
Freelance software developer. Working with Ruby and other ruby-flavored languages

🌉 bridged from ⁂ https://ruby.social/@fnordfish, follow @ap.brid.gy to interact
Pinned
Have yet to read the article. But. Docker is not a lock file. It’s a tarball of works-on-my-machine.
Ist there an easy* way of generating a list of all transitive dependencies of a Ruby project.

Start at a Gemfile, get everything that’s required to test and build everything.

*) since most gems define test dependencies in Gemfile, not gemspec, I’d probably we’d to download and unpack […]
Original post on ruby.social
ruby.social
January 17, 2026 at 9:41 AM
I’m looking for a post “Ruby app deployments for the paranoid”

- all dependencies are build on premise
- production servers never build dependencies
- …?
January 15, 2026 at 1:31 PM
Today is the first day I could use a beefier machine than my M3Max 64GB.
Building so many things again and again.
January 14, 2026 at 3:54 PM
BTW Using https://better-mouse.com/ for a while now and never looked back to Logitech Software
BetterMouse
Comprehensive mouse utility for macOS
better-mouse.com
January 7, 2026 at 4:57 PM
To everyone who is celebrating, have a happy and healthy #39c3
December 26, 2025 at 6:02 PM
Reposted by Robert
Package managers keep using git as a database, it never works out.

https://nesbitt.io/2025/12/24/package-managers-keep-using-git-as-a-database.html
Package managers keep using git as a database, it never works out
Using git as a database is a seductive idea. You get version history for free. Pull requests give you a review workflow. It’s distributed by design. GitHub will host it for free. Everyone already knows how to use it. Package managers keep falling for this. And it keeps not working out. ## Cargo The crates.io index started as a git repository. Every Cargo client cloned it. This worked fine when the registry was small, but the index kept growing. Users would see progress bars like “Resolving deltas: 74.01%, (64415/95919)” hanging for ages, the visible symptom of Cargo’s libgit2 library grinding through delta resolution on a repository with thousands of historic commits. The problem was worst in CI. Stateless environments would download the full index, use a tiny fraction of it, and throw it away. Every build, every time. RFC 2789 introduced a sparse HTTP protocol. Instead of cloning the whole index, Cargo now fetches files directly over HTTPS, downloading only the metadata for dependencies your project actually uses. (This is the “full index replication vs on-demand queries” tradeoff in action.) By April 2025, 99% of crates.io requests came from Cargo versions where sparse is the default. The git index still exists, still growing by thousands of commits per day, but most users never touch it. ## Homebrew GitHub explicitly asked Homebrew to stop using shallow clones. Updating them was “an extremely expensive operation” due to the tree layout and traffic of homebrew-core and homebrew-cask. Users were downloading 331MB just to unshallow homebrew-core. The .git folder approached 1GB on some machines. Every `brew update` meant waiting for git to grind through delta resolution. Homebrew 4.0.0 in February 2023 switched to JSON downloads for tap updates. The reasoning was blunt: “they are expensive to git fetch and git clone and GitHub would rather we didn’t do that… they are slow to git fetch and git clone and this provides a bad experience to end users.” Auto-updates now run every 24 hours instead of every 5 minutes, and they’re much faster because there’s no git fetch involved. ## CocoaPods CocoaPods is the package manager for iOS and macOS development. It hit the limits hard. The Specs repo grew to hundreds of thousands of podspecs across a deeply nested directory structure. Cloning took minutes. Updating took minutes. CI time vanished into git operations. GitHub imposed CPU rate limits. The culprit was shallow clones, which force GitHub’s servers to compute which objects the client already has. The team tried various band-aids: stopping auto-fetch on `pod install`, converting shallow clones to full clones, sharding the repository. The CocoaPods blog captured it well: “Git was invented at a time when ‘slow network’ and ‘no backups’ were legitimate design concerns. Running endless builds as part of continuous integration wasn’t commonplace.” CocoaPods 1.8 gave up on git entirely for most users. A CDN became the default, serving podspec files directly over HTTP. The migration saved users about a gigabyte of disk space and made `pod install` nearly instant for new setups. ## Go modules Grab’s engineering team went from 18 minutes for `go get` to 12 seconds after deploying a module proxy. That’s not a typo. Eighteen minutes down to twelve seconds. The problem was that `go get` needed to fetch each dependency’s source code just to read its go.mod file and resolve transitive dependencies. Cloning entire repositories to get a single file. Go had security concerns too. The original design wanted to remove version control tools entirely because “these fragment the ecosystem: packages developed using Bazaar or Fossil, for example, are effectively unavailable to users who cannot or choose not to install these tools.” Beyond fragmentation, the Go team worried about security bugs in version control systems becoming security bugs in `go get`. You’re not just importing code; you’re importing the attack surface of every VCS tool on the developer’s machine. GOPROXY became the default in Go 1.13. The proxy serves source archives and go.mod files independently over HTTP. Go also introduced a checksum database (sumdb) that records cryptographic hashes of module contents. This protects against force pushes silently changing tagged releases, and ensures modules remain available even if the original repository is deleted. ## Beyond package managers The same pattern shows up wherever developers try to use git as a database. Git-based wikis like Gollum (used by GitHub and GitLab) become “somewhat too slow to be usable” at scale. Browsing directory structure takes seconds per click. Loading pages takes longer. GitLab plans to move away from Gollum entirely. Git-based CMS platforms like Decap hit GitHub’s API rate limits. A Decap project on GitHub scales to about 10,000 entries if you have a lot of collection relations. A new user with an empty cache makes a request per entry to populate it, burning through the 5,000 request limit quickly. If your site has lots of content or updates frequently, use a database instead. Even GitOps tools that embrace git as a source of truth have to work around its limitations. ArgoCD’s repo server can run out of disk space cloning repositories. A single commit invalidates the cache for all applications in that repo. Large monorepos need special scaling considerations. ## The pattern The hosting problems are symptoms. The underlying issue is that git inherits filesystem limitations, and filesystems make terrible databases. **Directory limits.** Directories with too many files become slow. CocoaPods had 16,000 pod directories in a single Specs folder, requiring huge tree objects and expensive computation. Their fix was hash-based sharding: split directories by the first few characters of a hashed name, so no single directory has too many entries. Git itself does this internally with its objects folder, splitting into 256 subdirectories. You’re reinventing B-trees, badly. **Case sensitivity.** Git is case-sensitive, but macOS and Windows filesystems typically aren’t. Check out a repo containing both `File.txt` and `file.txt` on Windows, and the second overwrites the first. Azure DevOps had to add server-side enforcement to block pushes with case-conflicting paths. **Path length limits.** Windows restricts paths to 260 characters, a constraint dating back to DOS. Git supports longer paths, but Git for Windows inherits the OS limitation. This is painful with deeply nested node_modules directories, where `git status` fails with “Filename too long” errors. **Missing database features.** Databases have CHECK constraints and UNIQUE constraints; git has nothing, so every package manager builds its own validation layer. Databases have locking; git doesn’t. Databases have indexes for queries like “all packages depending on X”; with git you either traverse every file or build your own index. Databases have migrations for schema changes; git has “rewrite history and force everyone to re-clone.” The progression is predictable. Start with a flat directory of files. Hit filesystem limits. Implement sharding. Hit cross-platform issues. Build server-side enforcement. Build custom indexes. Eventually give up and use HTTP or an actual database. You’ve built a worse version of what databases already provide, spread across git hooks, CI pipelines, and bespoke tooling. None of this means git is bad. Git excels at what it was designed for: distributed collaboration on source code, with branching, merging, and offline work. The problem is using it for something else entirely. Package registries need fast point queries for metadata. Git gives you a full-document sync protocol when you need a key-value lookup. If you’re building a package manager and git-as-index seems appealing, look at Cargo, Homebrew, CocoaPods, Go. They all had to build workarounds as they grew, causing pain for users and maintainers. The pull request workflow is nice. The version history is nice. You will hit the same walls they did.
nesbitt.io
December 24, 2025 at 4:49 PM
Have yet to read the article. But. Docker is not a lock file. It’s a tarball of works-on-my-machine.
December 21, 2025 at 2:03 PM
I keep trying to use StringScanner, but then ending with something like that:

```ruby
last_pos=0
while (content.match(/pattern/, last_pos) do |m|
match_start = m.begin(0)
last_pos = match_start + 1
# do funny stuff on content everywhere after match_start
end); end
```
December 19, 2025 at 1:56 PM
Los it just me, or did #ios 26.2 got darker in the “tinted” option? Even compared to the beta and RC versions.
December 13, 2025 at 10:24 AM
I'm sorry, but if you newsletter flushes 8 DDH posts into my mailbox, that's a direct unsubscribe.
December 8, 2025 at 2:17 PM
Random thought:
OS distributions are just huge lockfiles
December 7, 2025 at 9:26 AM
Reposted by Robert
this fall I worked with the core Git folks on writing an official data model for Git and it just got merged! I learned a few new things from writing it. github.com/git/git/blob...
git/Documentation/gitdatamodel.adoc at master · git/git
Git Source Code Mirror - This is a publish-only repository but pull requests can be turned into patches to the mailing list via GitGitGadget (https://gitgitgadget.github.io/). Please follow Documen...
github.com
December 2, 2025 at 5:01 PM
Indeed it seems to be a filesystem quirk:

```
ls ß
ls: ß: No such file or directory

touch ss

ls -i ß ss
196004546 ss 196004546 ß
```
https://benjojo.co.uk/u/benjojo/h/h4N78m1PjXYsYfzkGV
This MacOS (APFS?) quirk was mentioned at the pub last night, and I still cannot believe this actually works when I tried it myself
benjojo.co.uk
November 27, 2025 at 3:18 PM
dev-product page: "[...] has AI built in to help you [...]" /close
November 18, 2025 at 5:10 PM
Good things happening for the wrong reasons part N+1:

`AGENTS.md` and general recommendations to write better documentation so that LLMs can “understand” them.
October 25, 2025 at 2:36 PM
General rule of thumb when creating a new SQL DB schema: For your ordinary primary key, instead of per-table auto increment, use a system wide unique ID from a single sequence or generator. So that no records in your system ever have the same ID.

The amount of bugs I caught early with that […]
Original post on ruby.social
ruby.social
October 24, 2025 at 2:49 PM
Reposted by Robert
I am awarded a gold medal by the Royal Swedish Academy of Sciences for my work on #curl

https://daniel.haxx.se/blog/2025/10/21/a-royal-gold-medal/
A royal gold medal
_The Royal Swedish Academy of Sciences_ (IVA, the same org that selects winners for three of the Nobel prize categories) awards me a gold medal 2025 for my work on curl. This academy, established 1919 by the Swedish king Gustav V, has been awarding _great achievers_ for over one hundred years and the simple idea behind the awards is, as quoted from their website: > Gold medals are awarded every year to people who, through outstanding deeds, have contributed to creating a better society. I am of course humbled and greatly honored to have been selected as a receiver of said award this year. To be recognized as someone who **have contributed to creating a better society** , selected by top people in competition with persons of remarkable track records and achievements. Not too shabby for a wannabe-engineer like myself who did not even attend university. There have been several software and tech related awardees for this prize before, but from what I can tell I am the first Open Source person to receive this recognition by the academy. ## Justification The Academy’s justification is given in Swedish (see below) but it should be translated roughly like this: _System developer Daniel Stenberg is awarded the IVA Gold Medal for his contributions to software development, where he has been central to internet infrastructure and free software. Through his work with curl, the tool that is now used by billions of devices worldwide, he has enabled reliable and secure data transfer over the internet. Not just between programs in traditional computers, but everything from smartphones and cars, to satellites and spacecraft._ The original Swedish “motivering”: _Systemutvecklare Daniel Stenberg tilldelas IVAs Guldmedalj för sina insatser inom mjukvaruutveckling där han haft en central betydelse för internetinfrastruktur och fri programvara. Genom sitt arbete med curl, verktyget som i dag används av miljarder enheter världen över, har han möjliggjort tillförlitlig och säker dataöverföring över internet. Inte bara mellan program i traditionella datorer utan allt från smartphones och bilar, till satelliter och rymdfarkoster._ ## The ceremony The associated award ceremony when the physical medal is handed over happens this Friday at the Stockholm City Hall‘s Blue Hall, the same venue used for the annual Nobel Prize banquet. I have invited my wife and my two adult kids to participate in those festivities. ## A _second_ medal indeed Did I not already receive a gold medal? Why yes, I did eight years ago. Believe me, it does not _get old_. This is something I can get used to. But yes: it is beyond crazy to get one medal in your life. Getting _two_ is simply incomprehensible. This is also my _third_ award received within this calendar year so I completely understand if you already feel bored by my blog posts constantly banging my own drum. See European Open Source Achievement Award and Developer of the year for the two previous ones. ## The medal I wanted to include a fine high resolution image of the medal in this post, but I failed to fine one. I suppose I will just have to make a few shots by myself after Friday and do a follow-up post!
daniel.haxx.se
October 21, 2025 at 6:32 AM
[Snark, nonsense]

I'm telling you, someone at AWS thought it would be a great idea to just replace that fragile DNS with some clever AI!
October 20, 2025 at 2:41 PM
We are currently replacing storage layers of a grown Ruby (off Rails) app, that strictly uses command patterns.
And I have to say, it’s was so worth doing it.
October 17, 2025 at 3:45 PM
TBH. This new Ruby taking stewardship of Rubygems and Bunder is actuallya good thing.
BUT - and I can’t put this in big enough letters - nothing on how we got there is even remotely reassuring.
October 17, 2025 at 3:30 PM
Reposted by Robert
I posted this at some point!
October 16, 2025 at 9:24 PM
Reposted by Robert
To sum up my rant, I do think #ruby still has a bright future ahead.

But it's bright not because of Shopify, or 37signals, or any of their apologists.

It's bright *in spite of them*.

Yes I'm going full hippie now, because we the people, the little folk, the community-minded people who just […]
Original post on indieweb.social
indieweb.social
October 9, 2025 at 5:15 PM
Some though spawn by the announcement of the gem.coop gems server:

- First of all, I believe it is a good thing.
- I can see multiple services start to mirror each other.
- How do we make sure we trust those mirrors to mirror correctly? (here's your "security" excuse)
- Do we need a new […]
Original post on ruby.social
ruby.social
October 7, 2025 at 9:19 AM
October 7, 2025 at 7:37 AM