Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rubygems.org AWS Root Access Event – September 2025

rubycentral.org

Post reply on HN
Print view View original

131–140 of 179 posts

Re: Rubygems.org AWS Root Access Event – September 2025

#131

Post by busterarm »

ctoth wrote: post #112
tptacek wrote: post #98

Earlier quoted context omitted.

Isn't the subtext of this post pretty clearly that the unauthorized actor was Andre Arko, who had until days prior all the same access to RubyGems.org already? The impression I have reading this is that they're going out of their way to make it clear they believe it was him, but aren't naming him because doing so would be accusing him of a criminal act.

Let's say that they are 100% correct, we parse the subtext as text, it was totally him. We still do not know the critical details of how (and when) he stored the root password he copied out of their password manager (encrypted in his own password manager? on his pwned laptop? in dropbox? we'll never know!) therefore the whole chain of custody is still broken.

Right but that speaks more to Andre's character, IMO.

Why are you copying a password out of a shared vault that should only be used in break-glass type scenarios? It's that's not planning for possible malicious action in the future, I don't know what is.

You can try and excuse it as having your own break-glass for the break-glass, but that's on the spectrum between irresponsible and incompetent.

Again, if the accusation is true, removing him was justifiable from any possible perspective you might have.

Re: Rubygems.org AWS Root Access Event – September 2025

#132

Post by anon84873628 »

JeremyNT wrote: post #93
eutropia wrote: post #4

They buried the lede... Arko wanted a copy of the HTTP Access logs from rubygems.org so his consultancy could monetize the data, after RC determined they didn't really have the budget for secondary on-call. Then after they removed him as a maintainer he logged in and changed the AWS root password.

What a truly wild situation. In a certain sense this post justifies why RC wanted so badly to take ownership - I mean, here you have a maintainer who clearly has a desire to sell user data to make a buck - but the way it all played out with terrible communication and rookie mistakes on revoking access undermines faith in RC's ability to secure the service going forward. Not to mention no explanation here of who legal…

I can give benefit of the doubt that making a proposal to monetize user data is a poorly-considered, bottom-scraping effort to find a replacement funding source for the on call work. Most of us would not consider it, but I think it should be ok to occasionally pitch some bad ideas, all else being equal and lacking full context.

But messing with the credentials crosses an ethical line that isn't excused no matter how much you disagree with the other party's actions.

Re: Rubygems.org AWS Root Access Event – September 2025

#133

Post by raggi »

Honestly I think everyone involved here, and I know most of them, needs to step back and grow up. Despite the formal tone, and the potential legal issues at play here, this situation seems to be descending into needless childishness with potential life damaging side effects. All sides are being disrespectful.

Re: Rubygems.org AWS Root Access Event – September 2025

#134

Post by brian_cunnie »

andrewguenther wrote: post #6

In 2025 there's no reason for anyone to be logging into an AWS account via the root credentials and this should have been addressed in the preventative measures. There's no actual control improvements here, just "we'll follow our procedures better next time" which imo is effectively doing nothing. Also this is really lacking in detail about how it was determined that no PII was accessed. What audit logs were checked?…

Sometimes I log into the root account to see the billing information.

I created an "administrator" account, but apparently it can't see the billing information, including the very-important amount of remaining cloud credits.

Maybe I could spend time fiddling with IAM to get the right privileges, but I have more pressing tasks. And besides, on my personal AWS account I only log in with the root account.

Re: Rubygems.org AWS Root Access Event – September 2025

#136

Post by JeremyNT »

anon84873628 wrote: post #132
JeremyNT wrote: post #93

Earlier quoted context omitted.

What a truly wild situation. In a certain sense this post justifies why RC wanted so badly to take ownership - I mean, here you have a maintainer who clearly has a desire to sell user data to make a buck - but the way it all played out with terrible communication and rookie mistakes on revoking access undermines faith in RC's ability to secure the service going forward. Not to mention no explanation here of who legal…

I can give benefit of the doubt that making a proposal to monetize user data is a poorly-considered, bottom-scraping effort to find a replacement funding source for the on call work. Most of us would not consider it, but I think it should be ok to occasionally pitch some bad ideas, all else being equal and lacking full context. But messing with the credentials crosses an ethical line that isn't excused no matter how…

I totally agree, assuming all this is accurate he immediately proved that RC was right all along to be concerned about him!

Re: Rubygems.org AWS Root Access Event – September 2025

#137

Post by picadi »

ctoth wrote: post #49
ctoth wrote: post #38

AWS account root access on a language package registry for 11 days. Not EC2 root - AWS account root. Complete control over IAM, S3, CloudTrail, every-damn-thing. They're claiming "no evidence of compromise" based on CloudTrail logs that AWS root could have deleted or modified. They even admit they "Enabled AWS CloudTrail" after regaining control - meaning CloudTrail wasn't running during the compromise window. You ca…

Thinking about this a bit more... it sure is interesting that around the time of a competing project launch that something just happens which might reasonably completely compromise trust in the previous incumbent, isn't it? Odd!

how can you trust gem.coop isn't already mining request logs + IPs to try and monetize lists of companies using specific packages & versions — besides the privacy/ethical concerns it is super useful data for hackers looking for vulnerable apps

no single person should have Github owner + AWS root password for a major language's package manager and ecosystem just sitting around on their laptop while they fly around to different conferences (as Andre seems to have done while showing off he still had the login to rubygem's AWS root account while in Japan)

Re: Rubygems.org AWS Root Access Event – September 2025

#138

Post by picadi »

eutropia wrote: post #4

They buried the lede... Arko wanted a copy of the HTTP Access logs from rubygems.org so his consultancy could monetize the data, after RC determined they didn't really have the budget for secondary on-call. Then after they removed him as a maintainer he logged in and changed the AWS root password.

really disappointing. it's such a huge security concern and privacy/ethical lapse, i am super disappointed in him, despite his contributions to the world of Ruby package management

he's now started a competing gem.coop package manager, and while they haven't released a privacy policy it does make me suspicious about how they were planning to fund it

no single person should have Github owner + AWS root password for a major language's package manager and ecosystem just sitting around on their laptop while they fly around to different conferences in Japan e.g. (as Andre did while hacking rubygem's AWS root account to show off)

Re: Rubygems.org AWS Root Access Event – September 2025

#139

Post by aeon_ai »

Imustaskforhelp wrote: post #127
aeon_ai wrote: post #125

Earlier quoted context omitted.

You’re taking the interpretation of the author of that article as the words that DHH said. Do you legitimately believe DHH would say those are his beliefs?

I hope that you have read the article but they have given a sound reasoning behind it. DHH mentions 39% or something which was the population of native white and not native british as an example... Please read the article link and they have given a proper sound reasoning... >Do you legitimately believe DHH would say those are his beliefs? Yes, I mean, DHH wrote it in his own blog post. There is still an argument to b…

> Why do you think such things are not what DHH believes in?

Because the one thing DHH doesn't do is shut up.

He hasn't really been the kind of person who minces words, he says what he thinks, and he is pretty unafraid of pissing people off. If he wanted to make explicit racist statements, it feels like he would make them.

My read is that this is broader commentary on civic/cultural integration. There are, fundamentally, immigration challenges that present themselves in modern society, especially when cultural values are different. I don't know that it's wise to believe that everyone will eventually see the world the same way, and we are then left with a question of how to reconcile that as we develop our societies and cultures.

Tommy Robinson is a violent anti-Islamic voice -- But, we've unfortunately found ourselves with those voices being the ones willing to speak to the problem that a growing portion of the population feels is unaddressed.

I don't think these are easy problems. I also cringe at calling Robinson's march "heartwarming" without qualification.

Yet I still am not willing to, without much stronger and more explicit evidence, read into DHH's words and label him a `far-right racist` -- Because I think that label loses effect when it's applied to every person that we disagree with on certain policy issues.

Re: Rubygems.org AWS Root Access Event – September 2025

#140

Post by picadi »

rgreeko42 wrote: post #63

So is this a smear of Arko (and by extension Ruby Gems' sloppy security) but dressed up like a Security disclosure? If I'm reading it right, it seems quite petty (and a bit cowardly). Arko was a maintainer was he not? How is that a breach? Presumably his credentials were not misbegotten, or is that the accusation?

one assumes he copied the AWS root password out of the RC-provided enterprise password manager / vault onto his own personally controlled password manager before he was locked out, which might be forgivable if it wasn't the root login for a major language's package registry
Post reply on HN