A Message from the Ruby Central Board

IMHO, Ruby Central keeps trying to find a way to frame all of this in a good light, but it seems like they keep falling flat. They tried doing filtered Q&A avoiding all the obvious questions that people hostile to what happened would ask, temporarily providing transparency reports that didn’t really say much. It all felt like very incompetent damage control.

I think they were hoping that handing it off to the Ruby core team would allow them to move on, but that requires ownership of their failings or at least actions that demonstrate that they will be better moving forward and none of that has happened.

> Ruby Central’s actions during this period were taken in response to a breakdown in a working relationship with an individual who had significant access to infrastructure and code > [...] > At the time, we believed a serious risk had been introduced to RubyGems and related services. > [...] > The review was ultimately inconclusive because key logs required for a complete analysis were no longer available. We recognize that this creates continued uncertainty.

So, after all that finger wagging and posturing around how the new RC regime was right to oust the previous maintainers, it turns out none of their justifications had any basis in fact? In all honestly this has just been one rake-step after another and I can't imagine how anyone could continue to be confident in their decision making.

Perhaps gem.coop might win out just by virtue of not putting themselves in these positions unnecessarily.

If

MINASWAN...

WTFIDHHSAFA???

I get downvoted here when I call him a racist.

> Ruby Central’s actions during this period were taken in response to a breakdown in a working relationship with an individual who had significant access to infrastructure and code.

This is the first time they’ve actually admitted that this was all about Andre.

> At the time, we believed a serious risk had been introduced to RubyGems and related services.

This doesn’t add up. Access was revoked and then temporarily restored. Nothing about this was mentioned in the meeting that took place before the access was removed again. See https://archive.org/details/gmt-20250917-160422-recording-64...

And what’s more, they didn’t even try to remove Andre’s access to AWS until he told them to.

> As stewards of services relied upon by millions of developers, we took that risk seriously and made the decision to act quickly to protect that infrastructure.

That’s not what Freedom said. Freedom said they needed to act quickly or lose funding.

https://apiguy.substack.com/p/a-board-members-perspective-of...

> A full, independent security audit has now been completed. The review was ultimately inconclusive because key logs required for a complete analysis were no longer available. We recognize that this creates continued uncertainty.

This makes it sound like there was some big security incident that they had to respond to. What actually happened is they forgot to remove Andre’s access to AWS and he told them and then they removed it. That’s it.

> Our intent was to stabilize a situation that was quickly escalating to work toward an amicable resolution.

If you watch the meeting (linked above) it’s clear that’s not what they were doing. This is a new spin they’ve come up with to justify it.

> Ruby Central did not initiate litigation and has consistently sought a path that would allow the community to move forward without prolonged conflict.

That is not what I’ve heard, but I’ll wait for others to post details of what’s happening in this space.

> At the same time, we recognize that aspects of how this situation was handled and communicated did not meet the expectations of the community.

They keep trying to admit fault in communication as if communication was the problem in an attempt to distract us from the fact they literally stole open source projects in a hostile GitHub takeover and used their privileges as administrators of RubyGems.org to take over the `bundler` package.