Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RubyGems Fracture Incident Report

rubycentral.org

Post reply on HN
Print view View original

31–40 of 46 posts

Re: RubyGems Fracture Incident Report

#31

Post by [deleted] »

busterarm wrote: post #10
RhythmFox wrote: post #8

Earlier quoted context omitted.

If this is a conflict of interest, then any Ruby core systems being controlled predominantly by members of the Shopify dev team is itself a conflict of interest. I am fine saying 'we need to make sure these libraries stay independent and community controlled', but that is so clearly not what was going on here. Believing that is just letting the RC FUD and PR control your thinking on the narrative.

I'm sorry but what are Shopify's business activities that directly compete with services provided/maintained by RubyCentral? As far as arguments about community, Shopify IS the community by virtue of being the ones putting up pretty much all the money to keep this ship afloat. If you don't have skin in the game your positions won't be taken seriously. Depending on your point of view, Sidekiq either turned their back…

[deleted]

Re: RubyGems Fracture Incident Report

#32

Post by Kina »

tuckerman wrote: post #13
RhythmFox wrote: post #6

Earlier quoted context omitted.

They are still trying to sue Andre, that is by definition claiming he did something illegal. The rest is just fluff to cover their insincerity (IMO).

The document didn't mention a lawsuit and I was just responding to the above comment with only the context of the postmortem and pointing out that this particular article didn't claim anything illegal happened. You and some others here might have much more context that I or other readers of this postmortem don't have. I seem to remember there were some threats of legal action related to unauthorized access after this…

There is a lot of tension that the report seeks to either minimize or avoid. It’s also just really hard to express it in a report like this because there’s no real place for it if the goal is to look professional.

I think the RubyGems fiasco was a result of unresolved tensions. People chose not to be adults about and resolve the issues respectfully. IMHO, I think one of the main problems is that nobody was willing to spin up a core foundation to own critical infrastructure to the Ruby community which remains a problem.

I cannot find the blogposts I remember reading, but recall that there were some bad feelings about Ruby Together and Arko’s leadership of it before it was merged with Ruby Central. It appears these feelings never went away which is made very clear by the way that key Shopify engineers started posting after Ruby Central took over the RubyGems GitHub org [1].

Now combine this with dhh’s right-wing political posts and behavior, his extremely close relationship with the founder of Shopify (dhh is on the board of Shopify), a key Ruby Central donor pulling critical funding because he did not want his money going towards giving dhh more attention and you’re left with Ruby Central effectively being controlled by Shopify (which, as far as I can tell is still the situation) because that’s where all of its funding comes from now.

Frankly, the biggest thing this entire fiasco has shown me is that a lot of us are still a bunch of idiotic teenagers. Integrity and maturity is in short supply where it is needed the most.

[1] https://bsky.app/profile/rmfranca.bsky.social/post/3lz7alpob...

Re: RubyGems Fracture Incident Report

#33

Post by smithcoin »

mpalmer wrote: post #7

This incident involved many people over a rather long time scale, and it was important to detangle how people perceived events from how they actually unfolded. The subject matter is deeply subjective, and multiple failed attempts at writing this doc came as a result of aiming for objectivity, for blameless representation. Therefore, those named in this report are: - Full-time employees of Ruby Central - Part-time con…

I read the article but I’m out of the loop enough to not understand Shopify and 37signals piece in this can you clarify? Is there another place I can be pointed to with that background information?

Re: RubyGems Fracture Incident Report

#34

Post by mperham »

busterarm wrote: post #24
mperham wrote: post #22

Earlier quoted context omitted.

> Do you have any idea how expensive it is to keep the infrastructure running? Yes, I do. All hardware and bandwidth are donated by Fastly and AWS so it costs RC nothing. Their expenses were $20,000/mo for 24/7 ops coverage: $2000/mo for 6 people and $8000/mo for service maintenance (e.g. db and software upgrades). So $240,000/yr, not "millions".

Care to cite the dollar amount of Shopify's yearly contribution (not even counting the humans doing actual labor) and what Sidekiq pulled in funding while you're at it?

I don't know the details of Shopify funding. I donated $250,000 in 2024 and withdrew a planned $250,000 donation in 2025, as has been widely publicized.

Re: RubyGems Fracture Incident Report

#35

Post by mperham »

busterarm wrote: post #20
themafia wrote: post #18

Earlier quoted context omitted.

Those who write the code have more of a right than those who pay the bills. Anyone can write a check. A select few have the acumen and experience to actually write the code. You can't unilaterally declare someone "sketchy" and then kick them out in the name of conveience.

No I'm calling him sketchy because that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. This is very openly discussed and documented and not just in the aftermath of this event. People having concerns about Andre's behavior around his money and his open source contributions can't even be called an open secret. The narrative that one side of this is pushing t…

> that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him.

I've known him personally for years and find him perfectly fine as a person. The Rubygems maintainers worked with him for the past decade without issue. Until you cite actual issues, not vague "concerns", you're just spreading FUD and innuendo.

Re: RubyGems Fracture Incident Report

#36

Post by steveklabnik »

busterarm wrote: post #20
themafia wrote: post #18

Earlier quoted context omitted.

Those who write the code have more of a right than those who pay the bills. Anyone can write a check. A select few have the acumen and experience to actually write the code. You can't unilaterally declare someone "sketchy" and then kick them out in the name of conveience.

No I'm calling him sketchy because that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. This is very openly discussed and documented and not just in the aftermath of this event. People having concerns about Andre's behavior around his money and his open source contributions can't even be called an open secret. The narrative that one side of this is pushing t…

> that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him.

Not an accurate characterization.

There are some people who do feel this way. But it's not everyone, by a long shot.

You are right that this ten year long interpersonal beef is ultimately at the root of all of this.

Re: RubyGems Fracture Incident Report

#37

Post by psadauskas »

Kina wrote: post #32
tuckerman wrote: post #13

Earlier quoted context omitted.

The document didn't mention a lawsuit and I was just responding to the above comment with only the context of the postmortem and pointing out that this particular article didn't claim anything illegal happened. You and some others here might have much more context that I or other readers of this postmortem don't have. I seem to remember there were some threats of legal action related to unauthorized access after this…

There is a lot of tension that the report seeks to either minimize or avoid. It’s also just really hard to express it in a report like this because there’s no real place for it if the goal is to look professional. I think the RubyGems fiasco was a result of unresolved tensions. People chose not to be adults about and resolve the issues respectfully. IMHO, I think one of the main problems is that nobody was willing to…

> I cannot find the blogposts I remember reading, but recall that there were some bad feelings about Ruby Together and Arko’s leadership of it before it was merged with Ruby Central.

This is one of the biggest ones that I remember:

https://web.archive.org/web/20180420220652/https://samphippe...

Re: RubyGems Fracture Incident Report

#38

Post by busterarm »

steveklabnik wrote: post #36
busterarm wrote: post #20

Earlier quoted context omitted.

No I'm calling him sketchy because that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. This is very openly discussed and documented and not just in the aftermath of this event. People having concerns about Andre's behavior around his money and his open source contributions can't even be called an open secret. The narrative that one side of this is pushing t…

> that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. Not an accurate characterization. There are some people who do feel this way. But it's not everyone, by a long shot. You are right that this ten year long interpersonal beef is ultimately at the root of all of this.

Honestly fair. There's a little too much of my personal distaste with his actions coming through here.

I think it's fairer to say that if you know him and you are in the community than you know that these opinions of him are had. That is not normal.

I also want to make it clear that there is a separation here. I do not think that Andre is a malicious or bad person. I just have questions about his decision-making based on things he's said & actions that he's taken and that leads me to think that he is untrustworthy. Not in the "will steal from me" sense but in the "will fuck up shit that I care about" sense (which ultimately he did, at least partly, whether through direct actions or poorly maintained relationships with key people). I work with this kind of infrastructure though and that's the kind of attitude that you want to have towards people to be able to do this job effectively. I don't trust a lot of people -- I want any access they have to be out in the open, limited to what's needed, etc. Governance of the project/organization was obviously a shit-show.

When I say that it's obvious to cut ties with him, I'm looking at it from the perspective of someone responsible for a high-profile project. I would make that decision 10 times out of 10 without regret. They still absolutely bungled the crap out of how that went down.

Also, I hate that this crap gets associated with the "Ruby Community". It's really just a subset of the western Ruby ecosystem that cares about foundations and events and semi-social functions. Ruby's core and a whole ecosystem of people working on and around Ruby couldn't give a crap about any of this and it's all just a massive inconvenience. Meanwhile on boards like this everyone is planting their flags and trying to exploit chaos to create change in critical services that people absolutely depend on.

Re: RubyGems Fracture Incident Report

#39

Post by busterarm »

mperham wrote: post #35
busterarm wrote: post #20

Earlier quoted context omitted.

No I'm calling him sketchy because that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. This is very openly discussed and documented and not just in the aftermath of this event. People having concerns about Andre's behavior around his money and his open source contributions can't even be called an open secret. The narrative that one side of this is pushing t…

> that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. I've known him personally for years and find him perfectly fine as a person. The Rubygems maintainers worked with him for the past decade without issue. Until you cite actual issues, not vague "concerns", you're just spreading FUD and innuendo.

I don't need to rehash 10+ years of documentation that's all over blog posts and prior threads on this very topic. Even if someone is unfamiliar with the details they can casually google RubyTogether and Andre and find out all kinds of details.

Don't pretend like I'm some nutter flinging wild accusations when primary and secondary actors in this story literally voiced these concerns in emails during this event.

Anyone who has been following this saga and actually cares knows because they read it already.

Re: RubyGems Fracture Incident Report

#40

Post by fhn »

itsdesmond wrote: post #19
busterarm wrote: post #12

Earlier quoted context omitted.

Do you have any idea how expensive it is to keep the infrastructure running? RubyCentral's operating expenses are in the millions every year and exceed their revenue. Andre's removal is easily justifiable by his own (lengthy history of) sketchy behavior. Since when is "open source" something businesses shouldn't be allowed to get value from or even have a stake in? These things are MIT licensed. That's free as in spe…

Responding to your first paragraph, the rest wasn’t constructive. Shopify paying for infrastructure related to Ruby is an investment, not charity. Hosting gems costs money and a healthy community depends on that gem hosting. Spotify, in turn, depends on that healthy community to produce and maintain gems, train future employees, stuff like that. They’re not paying that money for fun, it is to protect their interests.…

so you're saying Shopify should all funding. By your own reasoning, saying ALL companies should withdraw funding for ALL OSS projects.
Post reply on HN