Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

141–150 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#141

Post by undecisive »

fooqux wrote: post #129
undecisive wrote: post #102

Earlier quoted context omitted.

Yeah, certainly tickles a few neurons. I feel like BDFLs are akin to the concept of village elders; they're not immune to corruption or scandal, but they often have this beloved status that can paper over a lot of cracks. That's probably dependant on their leadership style - the hard headed (Linus, DHH) vs the grandfatherly (Matz, Van Rossum). Which, going back to your note on geopolitics, leads me to wonder: Is it j…

> I feel like BDFLs are akin to the concept of village elders; they're not immune to corruption or scandal, but they often have this beloved status that can paper over a lot of cracks. I think a lot of this is due to how so much is a scandal these days, for better and worse. (I'm obviously going to keep politics as much out of my response as possible.) A few decades ago, people could have political views without ostr…

No, I agree. That said, I think a lot of that particular shift is down to a) increased individualism b) an emphasis on the healing power of personal boundaries and c) the rejection of unity as an overriding good.

People are far more happy to cling to the tribe they choose, and the tribe that has their back, over the tribe they were born to. Then, there are those who see that trend as dangerous to society (where, in many cases, society is really just a proxy for their own power or social status - ironically as viewed through their own chosen tribes more than the tribe they were born to)

That is to say, I don't think it's the political views that are splitting the families. Individuals have decided that care for each other should come secondary to those political views. I feel like there used to be a certain amount of care in the "sweeping under the rug" - it was the tribe against the world, it was protecting the family image as much as it was protecting the individual from society. These days, being a thing "in private" means being a thing alone, and that's no longer a compelling thought when external tribes are willing to embrace you.

Which probably applies to software tribes just as much as family ones.

Re: Ruby core team takes ownership of RubyGems and Bundler

#142

Post by claudiug »

jcmfernandes wrote: post #135
claudiug wrote: post #99

Earlier quoted context omitted.

[flagged]

What wasn't factual in Joel's comment?

it paints all the stuff like is one person fault. omits to tell like stuff like

- gem.coop -> the person behind have a new tool rv that want to sell it

- they want to sell the rubygems logs to corporatins

- change the root pass at aws once they where remove from the project

small details like this.

Re: Ruby core team takes ownership of RubyGems and Bundler

#143

Post by ivan_gammel »

shevy-java wrote: post #116
ivan_gammel wrote: post #69

Earlier quoted context omitted.

The key question here is how exactly the supply chain attacks will be prevented. If you consider release of new version of a library some sort of transaction, it's easy to see then the difference with cryptocurrencies: in crypto transaction can be automatically verified, but with software releases it is impossible. It is hard to imagine hundreds of hostings on the same very high trust level, so either risks become si…

The supply chain attack is not the only argument here, though. For instance, who effectively controls the ruby ecosystem? See ad-hoc restrictions such as 100.000 downloads - past that point you are disowned from your own gem. I always felt that was a direct attack on independent developers. They could have forked those gems just fine (the licence permits this for most gems after all), but nope, they forbid you to rem…

Decentralization is not the answer to that though.

Re: Ruby core team takes ownership of RubyGems and Bundler

#144

Post by saghm »

ameliaquining wrote: post #87
shadowgovt wrote: post #57

Earlier quoted context omitted.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

This is missing an important part of the story that makes the Ruby Central side look relatively better, which is that one of the existing maintainers offered to help fill the funding gap in exchange for being allowed to monetize the server logs. https://rubycentral.org/news/rubygems-org-aws-root-access-ev...

Your addition also misses an important part where the only reason he was able to do that was because the servers were forcibly taken from the previous owners for the ostensible purpose of security, but the new regime forgot to change the passwords as part of that.

At this point, it's probable that any attempt to just list the pertinent events isn't going to end up being as neutral as one might hope because even the choice of what context to include or exclude is itself editorial. This is the same lesson people might learn in a high school history class, just applied to something much more recent.

Re: Ruby core team takes ownership of RubyGems and Bundler

#145

Post by Mystery-Machine »

rich_kilmer wrote: post #36
joeldrapper wrote: post #4

These projects were not Ruby Central’s in the first place. They were stolen for Ruby Central by a Ruby Core insider, HSBT. This is horrible news. They were stolen from André Arko, Colby Swandale, David Rodríguez, Ellen, Josef Šimánek, Martin Emde and Samuel Giddins.

They did not WRITE RubyGems, they inherited it and evolved it. Chad, David, Jim (RIP), Paul and I wrote RubyGems. I hosted RubyGems from my home in Virginia for several years before we could cover the cost of colocation and stood up RubyForge. Its nice to look at the near history and think that this is all of history but it is not. Ruby Central has always been the stewards of RubyGems and then later, Bundler.

First of all, thank you! It's unbelievable that you built the first version of `gem install` in a single night. It must have been an amazing feeling. I remember the drive when I was doing some hackathon with a few friends. It's the best feeling a software engineer can have.

When you left RubyGems and Bundler (let's call them "Projects") team, you handed over your authority to whoever was left and/or was added later. It doesn't matter in which order things happened. What matters is that Ruby Central _and the rest of the team_ were the stewards of Projects. The important part here being _and the rest of the team_. André had every right to keep being part of that team, and he was for a long time, together with many other team members, all of which were removed by "a representative from Ruby Central". What an inhuman way to remove someone from a Project. "Hire" someone to do the dirty job for you so you don't have to. The decisions in a team should be done by reaching a team consensus. Not by one actor. I believe it's for the better that André was removed from the team, but it shouldn't have been done like this. Ruby Central lost their trust in the eyes of many. They could've achieved the same goal in a much better way. How can I trust an organization with management of something if they failed to manage this whole situation? Claiming this is all in the name of security and then not even knowing how to properly remove access from someone. So much about security...

Re: Ruby core team takes ownership of RubyGems and Bundler

#146

Post by kragen »

shadowgovt wrote: post #57
neya wrote: post #35

Earlier quoted context omitted.

Any summary of what exaclty unfolded please (if you don't mind)? Sorry haven't been following the Ruby news for sometime.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

But Ruby Core is not the same thing as Ruby Central, apparently? This blog post says, "To provide the community with long-term stability and continuity, the Ruby core team, led by Matz, has decided to assume stewardship of these projects from Ruby Central. We will continue their development in close collaboration with Ruby Central and the broader community." What, if anything, is the relationshp between Ruby Core and gem.coop?

Re: Ruby core team takes ownership of RubyGems and Bundler

#147

Post by runjake »

overfeed wrote: post #138
runjake wrote: post #122

Earlier quoted context omitted.

It's news to me that the RubyCentral event had anything to do with DHH at least directly. You are alleging that Shopify was retaliating. Do you have any reliable context that Shopify was acting in a retaliatory manner?

I'm sure it's a total coincidence that Shopify (on whose board DHH sits) coincidentally became an active participant on toppling the maintainers soon after they criticized DHH. Given the power dynamics, the burden of proof is on Shopify to proove it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.

What you believe and what you can document are two separate things.

Per the concept of "innocent until proven guilty", there is no burden on Shopify to prove they didn't do what you believe. The burden is on you to provide evidence for the motivations behind their actions.

I personally doubt Tobi got Shopify to where it was by making rash decisions based on emotions and drama.

Re: Ruby core team takes ownership of RubyGems and Bundler

#148

Post by ameliaquining »

cyrnel wrote: post #133
ameliaquining wrote: post #87

Earlier quoted context omitted.

This is missing an important part of the story that makes the Ruby Central side look relatively better, which is that one of the existing maintainers offered to help fill the funding gap in exchange for being allowed to monetize the server logs. https://rubycentral.org/news/rubygems-org-aws-root-access-ev...

The response to that: https://andre.arko.net/2025/10/09/the-rubygems-security-inci...

This is about a different part of the controversy, and doesn't respond to the allegation of a monetization proposal.

Re: Ruby core team takes ownership of RubyGems and Bundler

#149

Post by saghm »

gcr wrote: post #51
byroot wrote: post #19

Ruby Central side: https://rubycentral.org/news/ruby-central-statement-on-rubyg...

For context, also check out their previous statement from September 19, which also "reflects our shared commitment to the long-term stability and growth of the Ruby ecosystem" [sic]: https://rubycentral.org/news/strengthening-the-stewardship-o...

> As the nonprofit steward of this infrastructure, Ruby Central has a fiduciary duty to safeguard the supply chain and protect the long-term stability of the ecosystem. In consultation with legal counsel and following a recent security audit, we are strengthening our governance processes, formalizing operator agreements, and tightening access to production systems.

It took less than two weeks from this statement for them to put out an incident report from them forgetting to change the password on the infrastructure they took from the previous maintainers. I can't say I'm shocked that this didn't actually result in people's confidence in their ability as steward to provide long-term stability for the ecosystem.

Re: Ruby core team takes ownership of RubyGems and Bundler

#150

Post by kragen »

dismalaf wrote: post #56
lyu07282 wrote: post #28

Earlier quoted context omitted.

This is just the tooling though, not "rubygems.org" which is still owned by a hostile entity (depending on where you sit on this), so not sure how this would restore any trust?

Hostile entity? The entity that has literally hosted them for their entire existence?

Apparently so. That shouldn't be a surprise; Amazon Web Services turned out to be hostile to WikiLeaks, CDDB's hosting turned out to be hostile to the community that built CDDB, coal mining company towns were hostile to miners' unions, and, in the final analysis, turkey farmers are hostile to the turkeys.
Post reply on HN