Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RubyGems Fracture Incident Report

rubycentral.org

Post reply on HN
Print view View original

41–46 of 46 posts

Re: RubyGems Fracture Incident Report

#41

Post by RhythmFox »

busterarm wrote: post #39
mperham wrote: post #35

Earlier quoted context omitted.

> that's the sentiment anyone who has been around in the community long enough and dealt with Andre has about him. I've known him personally for years and find him perfectly fine as a person. The Rubygems maintainers worked with him for the past decade without issue. Until you cite actual issues, not vague "concerns", you're just spreading FUD and innuendo.

I don't need to rehash 10+ years of documentation that's all over blog posts and prior threads on this very topic. Even if someone is unfamiliar with the details they can casually google RubyTogether and Andre and find out all kinds of details. Don't pretend like I'm some nutter flinging wild accusations when primary and secondary actors in this story literally voiced these concerns in emails during this event. Anyon…

I have read many of the allegations against Andre, and find them to fall into:

1) Hyperbolic takes on a perceived 'communication problem' when Andre defends strong design decisions that have impacts on the Ruby ecosystem. Anyone doing what Andre does is going to have impacts on the ecosystem, that is the point. I think the ease of maintaining Ruby systems speaks to the overall good outcomes these discussions have had, and Andre's part in them.

2) Personal dislike of Andre due to disagreements over politics and/or worldviews, usually stemming from assertions of 'woke code' or something like that.

3) Distaste over Andre trying to make a living off doing what they love. This is usually couched in the 'shady' type language you have used a few times. I think that is a weird take on what are just common schemes to use data for monetization purposes, so that Andre can make a living doing design and maintenance. Nothing I have ever seen makes me worried for my data in Bundler or Rubygems.

If your main concern is that 'bad things could happen with Andre running Bundler' I have to question if it isn't just as likely, if not more likely, that bad things will happen with a Shopify run RC board running Bundler. Their motivations are much less clear other than being a corporation that is profit driven, so I can't say with confidence they won't put that motive above 'good software decisions' when push comes to shove. I don't see them as de-facto making the Ruby supply chain better by any means. Time will tell.

Re: RubyGems Fracture Incident Report

#42

Post by schneems »

matharmin wrote: post #9

I can see a lot of time was put into the report, and it helps to have the detail, but in my mind it glosses over one of the most important parts: The dispute in the stewardship of the bundler and rubygems open-source projects. As I understand it, Ruby Central controlled the rubygems and bundler github organizations, but did not "own" the projects in the traditional sense - the individual contributers have copyright o…

> dispute in the stewardship of the bundler

This was never in dispute from the two parties. Ruby Central and "the maintainers" agreed from the beginning that it was collateral damage. The disagreement was what that meant and what to do with it. Hence the Sept 10 message from the Ruby Central Committee that they should move it to the Ruby core org (which IMO is long overdue).

The original plan (by the oss committee)was to move bundler to the Ruby org, that's what happened. When it did, the community generally like it (on HN and reddit comments).

Re: RubyGems Fracture Incident Report

#43

Post by itsdesmond »

fhn wrote: post #40
itsdesmond wrote: post #19

Earlier quoted context omitted.

Responding to your first paragraph, the rest wasn’t constructive. Shopify paying for infrastructure related to Ruby is an investment, not charity. Hosting gems costs money and a healthy community depends on that gem hosting. Spotify, in turn, depends on that healthy community to produce and maintain gems, train future employees, stuff like that. They’re not paying that money for fun, it is to protect their interests.…

so you're saying Shopify should all funding. By your own reasoning, saying ALL companies should withdraw funding for ALL OSS projects.

I absolutely didn’t say anything even similar to that. Are you ok?

Re: RubyGems Fracture Incident Report

#44

Post by fragmede »

mperham wrote: post #34
busterarm wrote: post #24

Earlier quoted context omitted.

Care to cite the dollar amount of Shopify's yearly contribution (not even counting the humans doing actual labor) and what Sidekiq pulled in funding while you're at it?

I don't know the details of Shopify funding. I donated $250,000 in 2024 and withdrew a planned $250,000 donation in 2025, as has been widely publicized.

As a British born Chinese American, thank you.

Re: RubyGems Fracture Incident Report

#45

Post by schneems »

mpalmer wrote: post #7

This incident involved many people over a rather long time scale, and it was important to detangle how people perceived events from how they actually unfolded. The subject matter is deeply subjective, and multiple failed attempts at writing this doc came as a result of aiming for objectivity, for blameless representation. Therefore, those named in this report are: - Full-time employees of Ruby Central - Part-time con…

> (2 current, 1 former) of Shopify's technical leadership

You'll have to take me on my word about it...but if I saw this as a driver of the issue I would have included it. I think saying "shopify was involved" is sort of like saying "people talked about RV at Rails World." Shopify is huge and hugely invested in Ruby's OSS ecosystem. I have my own critiques of the company, but not here. I think they're a net positive for Ruby OSS. I wish the general response was "more companies need to step up, I'll go talk to my leadership" rather than knocking these volunteers for their involvement. I've said elsewhere that if I were in the committee or in their shoes...I don't think the outcome would have been different (even if details would have). Also, you are welcome to disagree and have a different opinion.

I agree that it's best not to have situations like this. PSF bylaws "Section 5.15. Limits on Co-affiliation of Board Members." and similar rules are generally good at preventing the perception of conflict of interest (which is also important...that the perception alone can be damaging).

Right now, the committee is 100% one company (me). Because I'm the only one on it. Which is also a problem. Also, we're in a rebuilding/re-prioritizing phase with all of this...so it's hard to onboard while things are in flux.

Re: RubyGems Fracture Incident Report

#46

Post by schneems »

itsdesmond wrote: post #14
mpalmer wrote: post #7

This incident involved many people over a rather long time scale, and it was important to detangle how people perceived events from how they actually unfolded. The subject matter is deeply subjective, and multiple failed attempts at writing this doc came as a result of aiming for objectivity, for blameless representation. Therefore, those named in this report are: - Full-time employees of Ruby Central - Part-time con…

You’d think that name, Shopify, would appear three times, once per employee/committee member. Or just once, to say the entire OSS committee was employed by Shopify, if we’re still identifying the group strictly as a group. Either would be fine.

> Or just once, to say the entire OSS committee was employed by Shopify,

Mike works at Basecamp (now and then). Based on comms I don't believe any of them acted on behalf of their employer i.e. no "team orders." Or if they did, they did so in ways that aligned with my perception of what I believed to be the correct read of the situation.

I also think that we (as humans) are much less incapable of knowing what things sway and influence our opinions than we think. We are much less capable of correcting for conflicts of interest than we would like. The study "tappers and listeners" is about adjusting for knowledge (curse of knowledge), but I think it applies to influence as well. Which is to say...I'm sure that everyone was influenced in many ways, but I felt they acted as individuals and reacted in real time.

There are other details of affiliations that I omitted from the former maintainers as well, that are true to state, and likely had some impact on their decisions ... but I used judgment to omit what I didn't think was fair or didn't think was immediately relevant. Not saying I got it all right all the time, but sort of chiming in to say "I'm not only omitting information in favor of one party." Yes, I'm biased...but I'm trying to correct for that bias. (A funny thing to state after just saying humans are bad at it, I know).

Post reply on HN