Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rubygems.org AWS Root Access Event – September 2025

rubycentral.org

Post reply on HN
Print view View original

11–20 of 179 posts

Re: Rubygems.org AWS Root Access Event – September 2025

#11

Post by andrewmcwatters »

Ethical and legal boundaries? RubyGems Privacy Notice already tells you that they share information with a number of large firms and notably ClickHouse... for "Customer Data Processing."

All this proposal does is request from one of the maintainers/on-call providers? another entry in this Privacy Notice as a part of a payment deal.

This is a mess, but it also unnecessary smears both sides. It calls out that RubyCentral had poor cloud management in place, and it trashes an on-call provider.

This is a terrible postmortem and all it does is advertise to users that RubyCentral doesn't know what it's doing.

Re: Rubygems.org AWS Root Access Event – September 2025

#12

Post by ttfvjktesd »

> failed to rotate the AWS root account credentials ... stored in a shared enterprise password manager

Unfortunately, many enterprises follow the poor practice of storing shared credentials in a shared password manager without rotating them when an employee with prior access leaves the company.

Re: Rubygems.org AWS Root Access Event – September 2025

#13

Post by nerdjon »

andrewguenther wrote: post #6

In 2025 there's no reason for anyone to be logging into an AWS account via the root credentials and this should have been addressed in the preventative measures. There's no actual control improvements here, just "we'll follow our procedures better next time" which imo is effectively doing nothing. Also this is really lacking in detail about how it was determined that no PII was accessed. What audit logs were checked?…

> In 2025 there's no reason for anyone to be logging into an AWS account via the root credentials and this should have been addressed in the preventative measures.

I am curious what preventative measures you expect in this situation? To my knowledge it is not actually possible to disable the root account. They also had it restricted to only 3 people with MFA which also seems pretty reasonable.

It is not unheard of that there could be a situation where your ability to login through normal means (like lets say it relies on Okta and Okta goes down) and you need to get into the account, root may be your only option in a disaster situation. Given this was specifically for oncall someone having that makes sense.

Not saying there were not failures because there clearly are, but there have been times I have had to use root when I had no other option to get into an account.

Re: Rubygems.org AWS Root Access Event – September 2025

#14

Post by phoronixrly »

So we have DHH with his unhinged posts on one side, and Arko wanting to sell PII on the other. Great!

I think we need an f-droid-like project for Rubygems that builds the gems from source, and takes care of signing, and is backed by a non-profit that is independent from Rails/Shopify

Re: Rubygems.org AWS Root Access Event – September 2025

#17

Post by sersi »

terracatta wrote: post #8
codegeek wrote: post #7

"The root account credentials, essentially the highest level of administrative control, are stored in a shared enterprise password manager in a shared vault to which only three individuals had access: two current Ruby Central staff members and one former maintainer, André Arko" I am wondering. Did they at least have MFA enabled on the root login or not ?

Yes because they state under the section "Root Cause Analysis" > Ruby Central failed to rotate the AWS root account credentials (password and MFA) after the departure of personnel with access to the shared vault.

If both password and MFA are stored in the same shared vault then MFA's purpose is compromised. Anyone getting access to that shared vault has the full keys to the kingdom the same as if MFA wasn't enabled.

Also in this day and age, there's no reason to have the root account creds in a shared vault, no-one should ever need to access the root account, everyone should have IAM accounts with only the necessary permissions.

Re: Rubygems.org AWS Root Access Event – September 2025

#18

Post by hokumguru »

brunosutic wrote: post #15

Does anyone know if Arko can have legal troubles (like being sued) if it can be proven he "removed authorized users" from RubyCentral AWS account?

https://www.justice.gov/jm/jm-9-48000-computer-fraud

at least a misdemeanor. most of the time its prosecuted, a felony.

Re: Rubygems.org AWS Root Access Event – September 2025

#19

Post by dismalaf »

brunosutic wrote: post #15

Does anyone know if Arko can have legal troubles (like being sued) if it can be proven he "removed authorized users" from RubyCentral AWS account?

RubyCentral is a legal entity and they paid him for his work so they definitely could take action against him if he was shown to have harmed users or the company in any way.
Post reply on HN