Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

261–270 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#261

Post by re »

the_hangman wrote: post #206
saghm wrote: post #149

Earlier quoted context omitted.

> As the nonprofit steward of this infrastructure, Ruby Central has a fiduciary duty to safeguard the supply chain and protect the long-term stability of the ecosystem. In consultation with legal counsel and following a recent security audit, we are strengthening our governance processes, formalizing operator agreements, and tightening access to production systems. It took less than two weeks from this statement for…

Genuine question: how do you take something which you have already been paying for? They removed other maintainers access to their AWS account, and one of them had allegedly taken a screenshot of the root password from a password manager and logged in a few hours later and changed the root password to lock the legal owners out. Most of the community has turned on the maintainer who did that, it was extremely childish…

> They removed other maintainers access to their AWS account, and one of them had allegedly taken a screenshot of the root password from a password manager

Inaccurate:

> Ruby Central also had not removed me as an “owner” of the Ruby Central GitHub Organization. They also had not rotated any of the credentials shared across the operational team using the RubyGems 1Password account.

> I believe Ruby Central confused themselves into thinking the “Ruby Central” 1Password account was used by operators, and they did revoke my access there. However, that 1Password account was not used by the open source team of RubyGems.org service operators. Instead, we used the “RubyGems” 1Password account, which was full of operational credentials. Ruby Central did not remove me from the “RubyGems” 1Password account, even as of today. https://andre.arko.net/2025/10/09/the-rubygems-security-inci...

Ruby Central didn't realize that they hadn't actually revoked any access to the previous maintainers (and that they didn't have the updated root AWS credentials) until two weeks later when André notified them.

Re: Ruby core team takes ownership of RubyGems and Bundler

#262

Post by zahlman »

blibble wrote: post #170
brightball wrote: post #83

Earlier quoted context omitted.

He's also in a bit of a unique situation because of his public political profile was essentially forced. - Politics at work were becoming a huge problem at 37Signals - They asked that politics be kept out of company chats, but encouraged people to be political active on non-work channels/social media/etc even during work hours - People lost their minds at this incredibly reasonable request which then blew up on the i…

I more or less agree with the "no politics at work" stance but you've omitted his recent "contributions", where he went completely off the rails have a read of this https://world.hey.com/dhh/as-i-remember-london-e7d38e64 it's completely unacceptable, and he's promoting a self proclaimed fascist white nationalist (Tommy Robinson)

> I more or less agree with the "no politics at work" stance

> but you've omitted

I'm not that poster, but it was objectively correct to omit that, because it was as an objective matter of fact not "at work".

It does. Not. Matter. In this context what his beliefs are, or how they look to you through your lens.

In exactly the same way that, for example, the political views of GNOME and Xorg developers are not relevant to the development of those projects, and only become relevant when they get discussed in development spaces. (Or, you know, when they become the motivation for explicit interference in XLibre development.)

Re: Ruby core team takes ownership of RubyGems and Bundler

#263

Post by zahlman »

dash2 wrote: post #189
blibble wrote: post #170

Earlier quoted context omitted.

I more or less agree with the "no politics at work" stance but you've omitted his recent "contributions", where he went completely off the rails have a read of this https://world.hey.com/dhh/as-i-remember-london-e7d38e64 it's completely unacceptable, and he's promoting a self proclaimed fascist white nationalist (Tommy Robinson)

That's not quite accurate. Quoting chatGPT, since it may have more credible neutrality than my own opinion: """ Does Tommy Robinson call himself a "fascist" or "white nationalist"? No — Tommy Robinson (real name Stephen Yaxley-Lennon) does not call himself a fascist or white nationalist. He consistently rejects those labels, describing himself instead as a patriot, free-speech activist, or anti-Islamist campaigner. T…

I don't know why you were downvoted for this. The term "self-proclaimed" does actually mean something in English and is not just an intensifier.

Re: Ruby core team takes ownership of RubyGems and Bundler

#264

Post by zahlman »

basisword wrote: post #175
brightball wrote: post #83

Earlier quoted context omitted.

He's also in a bit of a unique situation because of his public political profile was essentially forced. - Politics at work were becoming a huge problem at 37Signals - They asked that politics be kept out of company chats, but encouraged people to be political active on non-work channels/social media/etc even during work hours - People lost their minds at this incredibly reasonable request which then blew up on the i…

I disagree. DHH said no politics at work. I thought that was great. A sensible moderate position at a time where people were getting polarised. Then he started a blog, built on his companies software, where he constantly shares extreme political opinions. When you are the public face of a company (and framework) and you are publishing your political opinions using your companies platform, you are now bringing politic…

> When you are the public face of a company (and framework) and you are publishing your political opinions using your companies platform, you are now bringing politics to work.

So Tim Cook would be "bringing politics to work" by posting politics on Twitter from an iPhone? Plenty of prominent Python community members, including core devs, have politics on their blogs and also use Python-powered technology (dedicated SSGs like Nikola, but also even Sphinx which is really meant for documentation) to generate and publish pages; is that "bringing politics to work"?

Re: Ruby core team takes ownership of RubyGems and Bundler

#265

Post by raggi »

rich_kilmer wrote: post #36
joeldrapper wrote: post #4

These projects were not Ruby Central’s in the first place. They were stolen for Ruby Central by a Ruby Core insider, HSBT. This is horrible news. They were stolen from André Arko, Colby Swandale, David Rodríguez, Ellen, Josef Šimánek, Martin Emde and Samuel Giddins.

They did not WRITE RubyGems, they inherited it and evolved it. Chad, David, Jim (RIP), Paul and I wrote RubyGems. I hosted RubyGems from my home in Virginia for several years before we could cover the cost of colocation and stood up RubyForge. Its nice to look at the near history and think that this is all of history but it is not. Ruby Central has always been the stewards of RubyGems and then later, Bundler.

i can confirm the above. sadly felt a confirmation might actually be helpful because there's some wild stuff around the threads today.

Re: Ruby core team takes ownership of RubyGems and Bundler

#266

Post by zahlman »

basisword wrote: post #234
blasphemers wrote: post #232

Earlier quoted context omitted.

That's not the case at all. His blog is his personal blog, not 37Signals, and he has never said employees were not allowed to share political opinions outside of work.

When you're the public face of a company you don't get to separate your personal political blogs from your work life. Your employees shouldn't know your political opinions and when you're that much in the public eye that means keeping them to yourself.

I genuinely don't understand why you believe this. Were you holding Bill Gates to the same standard when he still ran Microsoft? A charitable foundation is inherently political (it asserts the importance of the causes it financially supports, and holds them to represent matters of significant moral weight); should he not have put his and his wife's name on it?

Re: Ruby core team takes ownership of RubyGems and Bundler

#267

Post by zahlman »

shadowgovt wrote: post #65

Was there ever a mirror of this dustup in the Linux distro community? I'm unaware of one ever happening, and I'm wondering whether it's because of mere fortune or because there's something about the APT / dpkg model that precludes this kind of messiness. Perhaps the Ruby community is suffering the curse of having lived with reliable Internet for so long they never had to solve the problem of building up automatic pac…

The fact that you speak of "the Linux distro community" but also "the APT / dpkg model" is already telling. Most distros — i.e., everything not derived from Debian — don't even use the same package format. A lot of the problem has been mitigated simply by letting people choose among competitive suites of alternatives.

That said, there's been quite a bit of drama lately in prominent Linux projects — notably bcachefs, X11 (and the fork XLibre), and the Omarchy distribution (even connected to the current story!).

Re: Ruby core team takes ownership of RubyGems and Bundler

#268

Post by kbelder »

mindcrash wrote: post #182
shadowgovt wrote: post #57

Earlier quoted context omitted.

The broad-strokes story is: * DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate). * A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined. * In response to their decision,…

If only the drama stopped there: * DHH is not only considered racist / fascist due to some blog posts, but also for making Hyprland the default DE in Omarchy, developed by someone who goes by the name Vaxry Vaxerski, who is also considered fascist and racist, and thus banned from contributing to freedesktop projects due to supposed breach of CoC: https://blog.vaxry.net/articles/2024-fdo-and-redhat * Hyprland and all…

"Everyone is a fascist except me and thee, and I'm not sure about thee."

Re: Ruby core team takes ownership of RubyGems and Bundler

#269

Post by drbragg »

joeldrapper wrote: post #255
drbragg wrote: post #236

Earlier quoted context omitted.

This isn't true according to this article: https://www.404media.co/how-ruby-went-off-the-rails/ . Joel has a terrible habit of not citing his sources so I'm not sure if the post in question is the same but this seems to nullify that argument. TBF I do think there was pressure from Shopify to get compliance and security in order but saying "Shopify demanded that Ruby Central take full control of the RubyGems" is just…

Ruby Central is making legal threats to its critics, so I hope you can see why people don’t feel safe to come forward on the record. I can tell you that two people with direct knowledge of the situation told me that Shopify demanded that Ruby Central take full control of the RubyGems GitHub organisation and packages. You can believe that I am lying if you want. But I can’t directly cite my sources in this case.

I never said you were lying. I said the quote that person pulled from your article isn't true. IIRC your article came out before the one I linked came out.

Re: Ruby core team takes ownership of RubyGems and Bundler

#270

Post by hitekker »

dluan wrote: post #130
busterarm wrote: post #109

Earlier quoted context omitted.

Even if you're not an old-timer and don't remember what Ruby Together was like, the AWS root password changing shenanigans, presumably done by Arko, is enough of a red flag that nothing he's associated with has any credibility. No serious business with real (business) customers will accept that kind of risk and gem.coop will never be a thing outside of hobbyists.

Read his account of it ( https://andre.arko.net/2025/10/09/the-rubygems-security-inci... ) and you might change your mind (again).

I agree with busterarm's take. Andre Arko's story omits specific concerns like ssh'ing into Rubygems in Japan 9 days after the debacle. Further, his narrative excludes his termination email and instead focuses on generic platitudes his boss sent the group, to somehow prove Andre didn't know he was fired.

All in all, I don't see sound judgement from Andre Arko or from RubyCentral. That seems the common takeaway from neutral third parties https://archive.md/SEzoV

> Regarding Arko’s blog post about his removal, McQuaid [Homebrew Maintainer] told me it’s good that Arko is crediting other people for their contribution and that he’s following open source principles of community and transparency, but that “his ‘transparency’ here has been selective to things that benefit him/his narrative, he seems unwilling or unable to admit that he failed as a leader in being unwilling or unable to introduce a formal governance process long before this all went down or appoint a meaningful successor and step down amicably.”

Post reply on HN