Gemnasium

» see gemnasium.com as it lived, on the wayback machine

~ the obit ~

The problem Gemnasium existed for is one every working developer recognizes and almost nobody solves by hand. Your application pulls in forty libraries, those libraries pull in three hundred more, and somewhere in that tree a maintainer publishes a security advisory on a Tuesday that you will never read. The name is a joke about RubyGems, because Ruby is where the trouble was worst and where the service started.

Philippe Lafoucrière and his team built it in 2011 for themselves, running a set of Rails projects and losing the race to keep up with gem advisories. It watched your manifest, matched what was in it against published vulnerability data, and sent mail when something you depended on became a problem. Later it would open the pull request for you. By 2014 it covered npm and PyPI as well, with Java arriving through a Maven plugin, and it ran either on their servers or behind your own firewall if you preferred.

It became the reference tool in its category without ever becoming a large company. The last version of the homepage puts its own numbers in the hero: "Join the 20,000 users who rely on Gemnasium to monitor over 600,000 projects." That is a sentence written by a profitable small business with no reason to think it is nearly over.

~ the rap sheet ~

~ what free does to a price ~

In late 2017 GitHub turned on security alerts for every repository it hosted, at no charge. Gemnasium's business was almost entirely GitHub users, which had been its great advantage right up until the moment it was not. Churn doubled, monthly recurring revenue stopped growing, and Lafoucrière went looking for somewhere to land his team rather than watch the numbers finish the argument.

GitLab announced the acquisition on 30 January 2018 and set the shutdown for 15 May. Every engineer came across and the group was renamed GitLab's Security Products team, which shipped dependency scanning into GitLab CI about a month after arriving.

~ the customer wall ~

No press release lists who was paying, but the archived homepage prints them as image files, which is a habit of dead B2B products worth knowing about. Under the heading Trusted Globally sit Unity, SAP, Babbel, Vox, Funding Circle, Pivotal Labs and Wave. One more logo on that wall is codeschool-logo.svg, which is a grave on this site too, switched off by its own acquirer seventeen days after Gemnasium was.

~ what the name became ~

This is the part that makes Gemnasium unusual. The service is gone, but if you run dependency scanning on GitLab today, the job pulls a container image called gemnasium, and the Maven and Python variants are gemnasium-maven and gemnasium-python. A company that stopped existing in 2018 is still the name printed in the CI logs of everybody using the feature it turned into.

gemnasium.com itself spent three years after the shutdown redirecting to GitLab's documentation page for importing your old Gemnasium projects, which is the most practical goodbye in this entire category. The domain answers nothing at all now, on either scheme.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »