There are numerous questions here, but also a few answers. For instance, I pointed out days ago that Hiroshi Shibata did not act solo. Now this is confirmed - it was a matz directive. The main question to ask here is: could he not have made this open AND public from the get go? It would have lessened the confusion for some people. Unfortunately this also has a few added problems now, because ... say that you are an i…
Can you elaborate on sources about this: > Now this is confirmed - it was a matz directive. I did not see any confirmation in this annoucement, do I miss something?
Ruby core team takes ownership of RubyGems and Bundler
231–240 of 407 posts
Re: Ruby core team takes ownership of RubyGems and Bundler
#232Earlier quoted context omitted.
I disagree. DHH said no politics at work. I thought that was great. A sensible moderate position at a time where people were getting polarised. Then he started a blog, built on his companies software, where he constantly shares extreme political opinions. When you are the public face of a company (and framework) and you are publishing your political opinions using your companies platform, you are now bringing politic…
right, that's exactly what he did. "politics for me but not for thee"
Re: Ruby core team takes ownership of RubyGems and Bundler
#233Earlier quoted context omitted.
This is just the tooling though, not "rubygems.org" which is still owned by a hostile entity (depending on where you sit on this), so not sure how this would restore any trust?
Hostile entity? The entity that has literally hosted them for their entire existence?
Re: Ruby core team takes ownership of RubyGems and Bundler
#234Earlier quoted context omitted.
right, that's exactly what he did. "politics for me but not for thee"
That's not the case at all. His blog is his personal blog, not 37Signals, and he has never said employees were not allowed to share political opinions outside of work.
Re: Ruby core team takes ownership of RubyGems and Bundler
#235NGL, the drama is entertaining. I'm sorry for Ruby people that are negatively impacted, tho. Lastly, Matz is the best!
So this whole thing stems from a dislike of DHH? It also seems like rubygems.org could simply fork the rubygems code, perform whatever 'security and governance' changes they believed were needed in their fork, and run with that? Isn't that the open source way of handling disagreements in direction?
Because I once installed your project, I need to:
- Take over all of the accounts/access you AND all of your friends/co-maintainers used in connection with it
- Tell you it was a mistake, give back access temporarily
- Do it again!
- Have one of my board members who happens to be the treasurer say it was about the $
- Make a straight to camera YouTube post Addressing The Concerns
- Make a first "continuing our series of transparency" blog post a week later, where I use a dense corporate laden dialect to claim it was for the betterment of all mankind and definitely not about the $; because I need you to understand Where We Are Now; What This Is and What This Isn't.
- Open a Google forms question submission box.
- Smear your reputation, because you had an idea once about tracking which packages go to which companies; so I'll insinuate that you want to read everyone's mail and snoop through their undergarments drawer. What's that? My actions affected much more than just you? Quiet now, we're reshaping the narrative to smear you.
- Answer no questions, explaining that we chose to give you a regular series of Friday updates; but also We Want to Move On from the back and forth but also in that same publication have another go at the smear, because it partially worked.
- Donate the project to my state library, to take some of the heat off of me
Isn't that so much easier than typing "git clone" and "git remote add"?
(I am consistently flummoxed that a handful of people here are buying this narrative; instead of as you point out... Just applying a smidgeon of critical analysis about the usage of tools that the majority of us must use day to day and coming to the conclusion you do. Instead of doing this or accepting this conclusion, there's a frothy passion it seems for Appeal to Authority/Argument from Authority where any excuse, flaw, etc on the part of the maintainers is used to justify the whole chain of events.
It seems like it hits 5-7 facts and people can no longer manage them in short term memory, go and look at more than what is presented to them by a single party, etc; so they just default to the easiest mental shortcut.
For some reason I keep falling into the trap that "people are more educated, capable of critical thinking, and have easier access to data than ever before in history"; which I rationally know is not true)
Re: Ruby core team takes ownership of RubyGems and Bundler
#236As an outsider, I have two questions: - why is Shopify kind of hated in the comments? - what is it DHH said? Hoping for some context
I think because of this, which started this whole thing > Shopify demanded that Ruby Central take full control of the RubyGems https://joel.drapper.me/p/rubygems-takeover
Re: Ruby core team takes ownership of RubyGems and Bundler
#237These projects were not Ruby Central’s in the first place. They were stolen for Ruby Central by a Ruby Core insider, HSBT. This is horrible news. They were stolen from André Arko, Colby Swandale, David Rodríguez, Ellen, Josef Šimánek, Martin Emde and Samuel Giddins.
They did not WRITE RubyGems, they inherited it and evolved it. Chad, David, Jim (RIP), Paul and I wrote RubyGems. I hosted RubyGems from my home in Virginia for several years before we could cover the cost of colocation and stood up RubyForge. Its nice to look at the near history and think that this is all of history but it is not. Ruby Central has always been the stewards of RubyGems and then later, Bundler.
It may be best in the future direction to have Ruby Central's role on RubyGems and bundler completely eliminated and simply just hand them over to Ruby Core and Ruby Foundation in Japan. I will gladly donate just to avoid any more US politics and drama.
Re: Ruby core team takes ownership of RubyGems and Bundler
#238Re: Ruby core team takes ownership of RubyGems and Bundler
#239Earlier quoted context omitted.
That "Executive Director" (whose salary is probably safe throughout all controversies!) does not sound very credible compared to: https://andre.arko.net/2025/10/09/the-rubygems-security-inci... I'm only going by the corporate narrative structure of the director's post, who clearly wants to throw someone under the bus and cover up organizational incompetence. "Open" source has become so despicable.
Are you alleging that the screenshotted email isn't authentic? I'm only making a claim about that, not anything else.
"As this situation occurred, I was the primary on-call. My contractual, paid responsibility to Ruby Central was to defend the RubyGems.org service against potential threats."
Re: Ruby core team takes ownership of RubyGems and Bundler
#240Better Ruby core than Ruby Central but still leaves me wondering what the hell happened and slightly sours me on the whole ecosystem.
Candidly its decentralized nature when it comes to "packages" is one of its strengths. It does have downsides, and yes GitHub could be at issue at some point.
After this, after NPM compromises (left pad and more recently the supply chain attacks) why we arent seeing more community driven changes around decentralization and venturing is beyond me.