<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br><div><blockquote type="cite"><div>On 7 Apr 2024, at 09:22, Marten Feldtmann <m@feldtmann.online> wrote:</div></blockquote><br><blockquote type="cite"><div><div>
<blockquote type="cite">
<div>
Sadly, as the xz library issue just demonstrated again, this lack of contributions is not a problem unique to Smalltalk projects, but being non-mainstream does influence there’s even less people doing all the work.
</div>
</blockquote>
<div>
So, this is another good point to be oriented near the mainstream and not in a niche software development corner :-) - but the xz library shows the riscs of distributed, sometimes anonymous development. This also shows the riscs of a worldwide dependency of code. This has happened in the nodejs world and the NuGet packages world of .NET can also be a hell, if you want to maintain a software system over a long period of time.
</div></div></div></blockquote><div><br></div><div>I was actually referring to the real origin of why the hack was possible, which is more about open-source project interactions: <a href="https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/">https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/</a> </div><div><br></div><blockquote type="cite"><div>
<div class="default-style">
I noticed this, when I had to install a software at a customer with a very ristricted internet access. Was not able to install GsDevKit_home, I was not able to download gemstone. We had to request company-wide access rules for github and gemtalksystems. But when loading the GLASS code into a stone I got aware how many addresses are touched and I was not aware of that infrastructure in that way. It was not amused to go to the site administrator and hand him another webaddresses (from his perspective with strange names like smalltalkhub.xyz). So this changed my mind and it would change my mind of how GsDevkit should work (or how I should work with GsDevKit).
</div></div></blockquote><div><br></div><div>We’re deploying everything from a server in our control. Doing that is crucial to have reliable software deployment, imho. There’s documented ways of replicating source code locally and installing everything from there (Metacello API). Now, the GsDevKit_home setup process is not intended for that, but I also do not consider that project to be a deployment infrastructure.</div><div><br></div><div><blockquote type="cite">Well, regarding Gemstone ... I would expect GemtalkSystems to solve problems with starting/stopping of Linux services out of the box, also backup scripts and all of that. Perhaps one should look at PostgreSQL, what they deliver.</blockquote></div><div><br></div><div>Well... have you looked at the replacement project for GsDevKit_home: <a href="https://github.com/GsDevKit/GsDevKit_stones">https://github.com/GsDevKit/GsDevKit_stones</a> ?</div><div>This is what Dale is trying to tell you… it *is* there. I’m using it for the development of Seaside (the GemStone part at least).</div><div><br></div><div>Best regards</div><div>Johan</div><div><br></div><div><br></div></div></body></html>