Miss Dada  🏳️‍⚧️

@dwradcliffe Doing a story for @rubyfive on the gem replacement deal. Is there any integrity checking for .gem files when installing?

@olivierlacan @dwradcliffe @rubyfive on bundler/gem clients? no there isnt.

@arthurnn @dwradcliffe Ok, noted. Would I be a dick for suggesting we should do that on the podcast? Or is there an existing effort?

@olivierlacan @arthurnn I was thinking about that too. It's something we should consider, I think.

@dwradcliffe @arthurnn Wouldn’t this be an even better first step than pushing for gem signing?

@olivierlacan @dwradcliffe but indeed, it would be a good first step.

@arthurnn @dwradcliffe But what if it’s two endpoints? Doesn’t that reduce the likelihood of MITM? Get the .gem from one, the SHA elsewhere?