rfcs VS Babel (Formerly 6to5)

I can give a limited answer based on my own day-to-day work. I work in Ruby Dependency Security, which is the team who are most involved in helping out with rubygems.org and RubyGems work. Our biggest effort lately has been about rolling out MFA requirements for owners of top-most-downloaded gems. What I'd like to do afterwards is focus on gem signing using sigstore, which would make it a "one click" experience for authors. We did some work on it earlier this year[0] but chose to focus on MFA as our first big push. We also aim to devote a substantial fraction of our time to chopping wood and carrying water: looking at honeybadger exception reports, etc.

In terms of the long run there's a whole bunch that can be done to continuously harden every aspect of the Ruby supply chain. One thing we've been involved in founding is the OpenSSF Securing Software Repos working group[1], which has meant that RubyGems maintainers are now talking directly with folks from PyPI, npm, Maven Central, Cargo and others. We all face shared threats (eg, dependency confusion, resurrection attacks etc), so getting together to work collectively and share ideas has been super awesome.

[0] https://github.com/rubygems/rfcs/pull/37

[1] https://github.com/ossf/wg-securing-software-repos

That’s correct. If you’re a maintainer of a very popular gem, as of 15th August you’ll no longer be able to e.g. `gem push` if you haven’t enabled MFA on your RubyGems account. You will of course still be able to log in and enable it.

More details in the RFC: https://github.com/rubygems/rfcs/blob/master/text/0007-mfa-r...

> < 10% had useful 2FA enabled.

I expect this to change. NPM will roll out mandatory MFA for the most-downloaded packages[0] (RubyGems as well[1]). I expect this will rise to a 100% requirement at some point because Github's decision to require MFA by the end of 2023 will massively raise the waterline of folks who have the capability to MFA and experience with MFA.

[0] https://github.blog/2021-11-15-githubs-commitment-to-npm-eco...

[1] https://github.com/rubygems/rfcs/issues/35

The RFC trying to introduce sigstore for RubyGems is an interesting look at this in practice: https://github.com/rubygems/rfcs/pull/37

GitHub | Website

node 'node_modules/.bin/jest' '/Users/satparkash/code/test-app/src/A pp.test.tsx' -t 'App' FAIL src/App.test.tsx ● Test suite failed to run SyntaxError: /Users/satparkash/code/test-app/src/App.test.tsx: Support for the experimental syntax 'jsx' isn't currently enabled (6:12): 4 | describe('App', () => { 5 | it('should work as expected', () => { > 6 | render(); | ^ 7 | }); 8 | }); 9 | Add @babel/preset-react (https://github.com/babel/babel/tree/main/packages/babel-preset-react) to the 'presets' section of your Babel config to enable transformation. If you want to leave it as-is, add @babel/plugin-syntax-jsx (https://github.com/babel/babel/tree/main/packages/babel-plugin-syntax-jsx) to the 'plugins' section to enable parsing. Test Suites: 1 failed, 1 total Tests: 0 total Snapshots: 0 total Time: 0.278 s Ran all test suites matching /\/Users\/satparkash\/code\/test-app\/src\/App.test.tsx/i with tests matching "App".

Webpack (Babel) - https://babel.dev/

I do appreciate your transparency, though I disagree with the sentiment that I’m arguing from a position of bad faith.

It’s a self-evident fact that the Babel team has not shown a moment of interest in lowering their role in the JavaScript ecosystem to anything short of kingmakers. Have a gander at their GitHub README and what do we see?[1]

- “Babel is a compiler for writing next generation JavaScript.” Indefinitely.

- Over a dozen sponsor logos. An embarrassment of riches.

- A literal audio recording of a song in praise of the project.

The Babel team has a well documented history of their priorities[2], emphasizing the need for a modular approach that has no exit strategy[3]. At best, we have a case of accidental entrenchment and long term dependence on the Babel brewing as early as 2017![4]

Compare this infinite circus to the humble but popular Normalize.css, which has the express purpose to stop existing.[5]

If the Babel team wants to raise some money, they can start by putting a plan together that would codify an exit strategy. It’s certainly more noble than their current plan of barnacling on to every NPM package…

- [1] https://github.com/babel/babel

- [2] https://github.com/babel/notes

- [3] https://github.com/babel/notes/blob/master/2016/2016-07/july...

- [4] https://github.com/babel/notes/blob/master/2017/2017-04/apri...

- [5] https://nicolasgallagher.com/about-normalize-css/

The problem was I had used some new code, Javascript's replaceAll(), that is unsupported by older browsers. And, the setup I have to automatically fix such issues (called babel) is out of date. So, while this problem appears to be resolved there, I hadn't updated that in awhile.

babel-loader(v9.1.0): allows transpiling JavaScript files using Babel and webpack.

created 6 years ago to solve the specific problem of managing the Babel repo packages

https://github.com/babel/babel/discussions/13013 maybe this could help