Phil Haack

"Ruby is a "me too" on those fronts, and not a particularly novel one."

Of course. No one, especially not Matz, ever claimed Ruby was novel. Why should I care whether a language feature is new when I have features to ship? What you seem to be dogmatically, blindly ignoring is that Ruby's peculiar amalgamation of existing techniques, borrowed from (standing on the shoulders of) Smalltalk, Perl, Python, certain aspects of Lisp and others, created an expressiveness with those idioms that invited widespread adoption that Smalltalk and Lisp in all their glory only ever dreamed of. Innovation was the least of Ruby's concerns, and it's irrelevant to the conversation at hand.

Type-safety seems to be a big thing for you. This may seem to be an enormous advantage to you, and I wish you well. I personally think type safety is the most overrated language feature in CS history. In my crankier moments I'd say it's essentially a compile-time unit test and refactoring/code-browsing crutch for IDE-jockeys that don't test their code. In my less-cranky moments...I'll probably say the same thing. And that's after a decade and an half in Java and C#, not quite a decade in Ruby. To me, type safety imposes far more overhead than it's worth -- generics, abstract classes, interfaces, all irrelevant and basically built-in and implicit in dynamic environments like Ruby. But that's another digression. Suffice it to say, in my entire software career I've kept track of the sum total of bugs I've fixed…

Very exciting to finally see semver get some traction in one way or another! A very welcome decision and announcement, also supported by Haacked's post[1].

[1]: https://haacked.com/archive/2019/02/11/semver-collective/

I have been quite active around the semver repo for a few years after 2.0.0 was released initially and participated in a lot of significant discussions that, to this day, still remain unresolved without either affinity to them or a stated rejection. After many years of seeing the same questions and suggestions pop up with no progress in sight, I just slowly lost hope and once issue updates started piling in to close issues at the initiative of @jwdonahue (thanks, by the way) without advancing any discussion or subject, I just unsubscribed. I am really exited about the things that are to come and will gladly try to participate in discussions to the best of my abilities.

Currently, there are quite a few things that SemVer needs to decide on (not necessarily implement), but imo the important points are:

1. How are versions selected? You mentioned this in the thread already, but this point is hugely lackluster about the current situation. See issue #205 for the biggest discussion to date and many cross-references.

1.1 Build metadata, especially in the context of version selectors, kind of "just exist". They serve mostly as a "catch all" for various things you might want to annotate a version, but there are no rules or use cases for them.

2. (Automatic)…

Not sure why this is getting voted up so much. The author came across a report of IE freezing/crashing, replicated it, and Microsoft fixed it. In the same security update (http://technet.microsoft.com/en-us/security/bulletin/ms13-037) there are 10 other vulnerabilities described in the same way. Why is this particular vulnerability noteworthy or interesting, other than the fact that someone stumbled across it and documented it before it ended up reported to Microsoft?

In fact, CVE-2013-1297 from that same security update (which I didn't know existed until now) is far more interesting from a security perspective (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1297).

Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."

Similar JSON information disclosure can be very serious for a web application. http://haacked.com/archive/2009/06/24/json-hijacking.aspx describes the general issue in some depth. The fact that it was possible to use vbscript as a way to read in cross-domain JavaScript is very important from a security perspective.

There's two problems:

1. generating code in the problem area (email address validation) which is pretty much a classic 'things programmers believe about' domain - https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/

2. generating code in a programming idiom with which you are unfamiliar - which regex as a DSL is also a pretty classic example. I don't think most programmers are good at regex, I know I'm definitely in the 'now you have two problems' in the regex camp.

So to summarize it generated code written in a way the programmer could not understand what it even claimed to be doing, using a technology that many programmers are not especially good at; and it generated code that did not handle the problem domain correctly, and the problem domain is one that most programmers don't actually know that well either.

the more I think of this thing the more disastrous it seems.

This reminds of "Argue well by losing" [1]. The purpose of debate shouldn't be to win or lose, but to reach consensus.

In addition, the ancients of the classical world regarded "Rhetoric" (ie the ability to debate) as being the highest form of intelligence. It required not only a deep understanding of the reasoning behind your own opinion but also an equally deep understanding of that of your collocutors. Ie, you should be able to argue in favour of his/her point as well as your own, and as well as he/she can. That takes wisdom and humility that most today seem to lack.

[1] - https://haacked.com/archive/2013/10/21/argue-well-by-losing.aspx/

yeah, the term I'd use is source available? anyway, I agree with the idea that "open source" is a dirty term, an attempt to subvert the free software movement. But that is a battle for another day.

Someone else put it better than I could:

> Likewise a Source Available is not necessarily Open Source, but Open Source is necessarily Source Available.

https://haacked.com/archive/2006/07/26/CodeAvailableVsOpenSourceVsFreeSoftware.aspx/ (requires you to accept github cert because https is difficult for some reason)

Blog github at https://github.com/Haacked/haacked.com