Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby core team takes ownership of RubyGems and Bundler

ruby-lang.org

Post reply on HN
Print view View original

391–400 of 407 posts

Re: Ruby core team takes ownership of RubyGems and Bundler

#391

Post by tptacek »

justinclift wrote: post #390
tptacek wrote: post #365

Earlier quoted context omitted.

The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to q…

> We also know that (4) he attempted to quietly monetize the server logs from RubyGems. What sort of monetisation? Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(

What kind of monetization would have been OK?

Re: Ruby core team takes ownership of RubyGems and Bundler

#392

Post by roryirvine »

notepad0x90 wrote: post #380
gls2ro wrote: post #362

Earlier quoted context omitted.

Let me ask you a different question: Would they be where they are today if there weren't been built at that moment with Ruby? Both these questions are hard to answer without connecting the dots, looking backward. Github was started in 2007, Shopify in 2006, Gitlab in 2011, Whop in 2021 It takes a long time approximately for a company to get out of the medium zone and go really big. So the only answer for this is we d…

I don't know. Do programming languages really make that big of a difference, other than with developer unhappiness and talent scarcity when hiring? I think how many quality devs you can hire with that language is really the only question that matters 90% of the time (ballparking), so long as the language is designed for that use case, like don't use assembly to write a production webapp. I don't know many devs that c…

Honestly, if you're even slightly concerned about Go's memory footprint and optimization then you shouldn't bother digging any further into Ruby.

There's a reason that the DevOps world abandoned Ruby wholesale in the late 2010s (mostly replacing it with Go).

In a world where container orchestration allowed servers to be more fully utilised, it became increasingly obvious that the ancillary tooling (think log shipping or metrics collection) often had a larger memory and CPU footprint than the core service itself.

Formerly popular tools in this class like Sensu or fluentd have either been rewritten or replaced with Go equivalents, and Ruby seems to be more or less dead for new projects outside of the Rails niche.

Re: Ruby core team takes ownership of RubyGems and Bundler

#393

Post by [deleted] »

mijoharas wrote: post #350
throwawaypath wrote: post #348

Earlier quoted context omitted.

>He complains about non-white people that are born in England. No he doesn't. He specifically states "native Brits." The only "Brits" native to Great Britain are White Brits. In addition, "around 41% of [London's] population were born outside the UK" [0]. Nearly half of the city is foreign. [0] https://en.wikipedia.org/wiki/Ethnic_groups_in_London

So, anyone non-white in the UK isn't native? If they're third generation british? What about the royal family, Prince Philip was Danish/Greek, so the royal family aren't native are they? Shall we stop pretending this about anything other than race?

[deleted]

Re: Ruby core team takes ownership of RubyGems and Bundler

#394

Post by throwawaypath »

mijoharas wrote: post #350
throwawaypath wrote: post #348

Earlier quoted context omitted.

>He complains about non-white people that are born in England. No he doesn't. He specifically states "native Brits." The only "Brits" native to Great Britain are White Brits. In addition, "around 41% of [London's] population were born outside the UK" [0]. Nearly half of the city is foreign. [0] https://en.wikipedia.org/wiki/Ethnic_groups_in_London

So, anyone non-white in the UK isn't native? If they're third generation british? What about the royal family, Prince Philip was Danish/Greek, so the royal family aren't native are they? Shall we stop pretending this about anything other than race?

>So, anyone non-white in the UK isn't native?

Anyone not White British. Austrians are White and are similarly not native to London.

>What about the royal family, Prince Philip was Danish/Greek, so the royal family aren't native are they?

Who made the claim that Prince Philip was White British or native to London?

>Shall we stop pretending this about anything other than race?

Just because you've been duped by propaganda doesn't mean anyone is pretending.

Re: Ruby core team takes ownership of RubyGems and Bundler

#395

Post by hitekker »

jcmfernandes wrote: post #342
tptacek wrote: post #314

Earlier quoted context omitted.

He changed the AWS root password for the account.

Yes, and he already explained why he did it. Yes, he should have communicated it clearly. That's on him. At the same time, why didn't RC call him to ask? Was it easier to write about a security INCIDENT throwing shade at Arko? With that said, let's keep focused on the real issue: RC did a hostile takeover of the projects. That's not been properly disputed so far. Matz is, therefore, accepting to steward stolen projec…

João, you're going to have to work a lot harder than this to cancel Matz.

Re: Ruby core team takes ownership of RubyGems and Bundler

#396

Post by [deleted] »

dismalaf wrote: post #375
jcmfernandes wrote: post #370

Earlier quoted context omitted.

> It doesn't matter why you break into your former employer's server. Arko already stated that he didn't know he had been fired. Geez. > You know Arko didn't even start working on Rubygems until it was nearly 10 years old, right? The project was stolen from a set of maintainers, not just Arko. Let's stick to the facts: someone with admin rights over the repos revoked the access of other admins without their consent.…

> have a lot of respect for Rich, but he wasn't a maintainer. LMAO No. He's one of the few people on the planet that could lay claim to it's copyright. He also gave the insight that Rubygems has literally ALWAYS been a part of RubyCentral.

[deleted]

Re: Ruby core team takes ownership of RubyGems and Bundler

#397

Post by dluan »

hitekker wrote: post #270
dluan wrote: post #130

Earlier quoted context omitted.

Read his account of it ( https://andre.arko.net/2025/10/09/the-rubygems-security-inci... ) and you might change your mind (again).

I agree with busterarm's take. Andre Arko's story omits specific concerns like ssh'ing into Rubygems in Japan 9 days after the debacle. Further, his narrative excludes his termination email and instead focuses on generic platitudes his boss sent the group, to somehow prove Andre didn't know he was fired. All in all, I don't see sound judgement from Andre Arko or from RubyCentral. That seems the common takeaway from n…

I don't know enough of the fine details, but I believe Andre when he says he was acting in the best interest of the community and in his job as a maintainer, and his actions were exacerbated by the lack of clarity from Ruby Central. I don't know about the previous politics between Andre and Ruby Central when their orgs merged, but based on the comments from the other Ruby Central maintainers, I will always side with maintainers first.

Re: Ruby core team takes ownership of RubyGems and Bundler

#398

Post by jcmfernandes »

hitekker wrote: post #395
jcmfernandes wrote: post #342

Earlier quoted context omitted.

Yes, and he already explained why he did it. Yes, he should have communicated it clearly. That's on him. At the same time, why didn't RC call him to ask? Was it easier to write about a security INCIDENT throwing shade at Arko? With that said, let's keep focused on the real issue: RC did a hostile takeover of the projects. That's not been properly disputed so far. Matz is, therefore, accepting to steward stolen projec…

João, you're going to have to work a lot harder than this to cancel Matz.

You misspelled accountable.

Re: Ruby core team takes ownership of RubyGems and Bundler

#399

Post by justinclift »

tptacek wrote: post #391
justinclift wrote: post #390

Earlier quoted context omitted.

> We also know that (4) he attempted to quietly monetize the server logs from RubyGems. What sort of monetisation? Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(

What kind of monetization would have been OK?

People are saying that this person just scanned the logs to gain an idea of the larger (commercial?) users, with the idea of approaching them for potential sponsorship.

To me that seems like a good idea, not like a betrayal of trust as some people have been making out.

Re: Ruby core team takes ownership of RubyGems and Bundler

#400

Post by ignurant »

notepad0x90 wrote: post #360
gls2ro wrote: post #354

Earlier quoted context omitted.

> If you want to build a small, modest complexity web app with like 1 or 2 developers and under maybe 6 months of active development, modest traffic needs, etc, it's a good way to get everything up and running fast with best-practices for everything. Of course lets silently ignore Github, Gitlab, Shopify and others: all small, modest complexity web apps built with Ruby on Rails. Look at Shopify last year black friday…

But would they still build with Ruby if they had to rewrite it today? It seems other commenters are saying they wouldn't. I wanted to see if it offered anything more than my python and Go preference.

For what it's worth, the last few years our we've sliced off a few custom client apps in Rails and it's felt like a great tailwind. We've been running a profitable BI app for around 15 years, but it's really hard to maintain. The dev team decided we want to rewrite it from .NET, Python, React into vanilla full-stack Rails. We were planning to rewrite it anyway to fix many old assumptions that turned out to be wrong and made maintenance a lot harder. It should also reduce the required coordination of backend API + frontend being that it's more cohesively developed together. But ultimately, we've enjoyed using an opinionated framework that has all the typical "web app" things batteries included and well-established. It helps discovery.

I think it works well for SaaS type offerings where you have a low number of high-value clients. We don't do high-traffic public sites. Perhaps my opinion would be different then.

Post reply on HN