That's not Bundler's fault. It's the fault of the person who made the versionless Gemfile.

There's really no comparison between using Bundler and mucking around with JAR files or Ant scripts in Java. I've even seen Python codebases with a Java-esque rats nest of dependencies that are just as painful to get setup correctly.

Bundler is way easier. I've never been on a Rails project where it took more than 30 minutes to get the env setup and it's in large part, thanks to Bundler. Admittedly, I haven't touched Java in a few years, but last I checked, Java had nothing like Bundler (which is a shame, because it could really use it).

Maven and POM files are the standard way of managing dependencies in Java projects. Maven's more complex than bundler, but reasonably easy to use as it is very convention oriented.

Hey, don't forget Gradle - http://www.gradle.org - Gradle syntax for declaring dependencies is similar to Maven.

But there's a very close comparison between Bundler and managing dependencies with Maven or Gradle. And there's a huge difference. Maven Central has never been compromised because they have a secure method for deploying artifacts, RubyGems? You've had a fun month with RubyGems, right?

If you are going to base your argument on a one-time security vulnerability in RubyGems, then I'm just going to get out of your way and let you troll on.

If you are using Play or Grails then dependency management is handled almost identically to bundler.

If not then Ivy is what is used mostly albeit far less elegantly.