Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rubygems.org AWS Root Access Event – September 2025

rubycentral.org

Post reply on HN
Print view View original

91–100 of 179 posts

Re: Rubygems.org AWS Root Access Event – September 2025

#91

Post by saghm »

shevy-java wrote: post #52

I'd recommend to people to wait for a response - RubyCentral spins up a gazillion accusations right now and has been in the last days (and, it is also incomplete, because why did they fire every dev here and placed Marty Haught in charge specifically? They never were able to logically explain this; plus, why didn't they release this write-up before? It feels very strange to wait here; they could have clarified things…

Yeah, this is incredibly confusing. The stance that Ruby Central has stated since the takeover of the RubyGems (offline) tooling on Github was that it was necessary for supply chain security, but if this happened literally within a couple of weeks of when they tried (and apparently failed?) to remove all of the previous maintainers, how does this add any amount of confidence in their ability to secure things going forward? If they can't even properly remove the people they already knew had access that they went out of their way to try to remove, it's hard to feel like consolidating their ownership over all of the tooling is going to be an improvement.

Re: Rubygems.org AWS Root Access Event – September 2025

#92

Post by nomdep »

> “Following these budget adjustments, Mr. Arko’s consultancy, (…), submitted a proposal offering to provide secondary on-call services at no cost in exchange for access to production HTTP access logs, containing IP addresses and other personally identifiable information (PII). The offer would have given Mr. Arko’s consultancy access to that data, so that they could monetize it by analyzing access patterns and potentially sharing it with unrelated third-parties.”

WTF. This is the same guy that is launched gems.coop, a competing index for Ruby gems recently.

On the other hand, RubyCentral actions were truly incompetent, I don’t know anymore who is worse

Re: Rubygems.org AWS Root Access Event – September 2025

#93

Post by JeremyNT »

eutropia wrote: post #4

They buried the lede... Arko wanted a copy of the HTTP Access logs from rubygems.org so his consultancy could monetize the data, after RC determined they didn't really have the budget for secondary on-call. Then after they removed him as a maintainer he logged in and changed the AWS root password.

What a truly wild situation.

In a certain sense this post justifies why RC wanted so badly to take ownership - I mean, here you have a maintainer who clearly has a desire to sell user data to make a buck - but the way it all played out with terrible communication and rookie mistakes on revoking access undermines faith in RC's ability to secure the service going forward.

Not to mention no explanation here of who legally "owned" the rubygems repo (not just the infra) and why they thought they had the right to claim it, which is something disputed by the "other" side.

Just a mess all around, nobody comes off looking very good here!

Re: Rubygems.org AWS Root Access Event – September 2025

#94

Post by jaredcwhite »

RhythmFox wrote: post #71
andrewmcwatters wrote: post #11

Ethical and legal boundaries? RubyGems Privacy Notice already tells you that they share information with a number of large firms and notably ClickHouse... for "Customer Data Processing." All this proposal does is request from one of the maintainers/on-call providers? another entry in this Privacy Notice as a part of a payment deal. This is a mess, but it also unnecessary smears both sides. It calls out that RubyCentr…

[flagged]

I have no doubt a certain contingent who tend to flock on a certain former bird-themed network are happily spreading their votes around.

Re: Rubygems.org AWS Root Access Event – September 2025

#95

Post by tptacek »

Presuming, as a group full of security peers kibitzing about this in a chat right now all do, that the "unauthorized actor" here is Andre Arko, this is Ruby Central pretty directly accusing Arko of having hacked Rubygems.org; it depicts what seems to be a black letter 18 USC 1030 violation.

Any part of this narrative could be false, but I don't see a way to read it and take it as true where Arko's actions would be OK.

Re: Rubygems.org AWS Root Access Event – September 2025

#96

Post by saghm »

dismalaf wrote: post #58
shevy-java wrote: post #52

I'd recommend to people to wait for a response - RubyCentral spins up a gazillion accusations right now and has been in the last days (and, it is also incomplete, because why did they fire every dev here and placed Marty Haught in charge specifically? They never were able to logically explain this; plus, why didn't they release this write-up before? It feels very strange to wait here; they could have clarified things…

> let those accused respond. Literally all we've heard so far is from the other side... > If they have factual evidence, they need to bring the matter to a court I'd be surprised if they aren't. This post feels very much like the amount of disclosure a lawyer would recommend to reassure stakeholders. > rules of engagement that doesn't put rich corporations atop the whole ecosystem Right now the only thing stopping us…

The rogue maintainers have apparently been been successful enough with their stewardship for years to the point that people still use and care about the tools they had maintained today. On the other hand, the new maintainers sponsored by the rich corporation have managed to draw scrutiny immediately about how they became the new maintainers and apparently failed to effectively protect their new assets from a major breach within two weeks of acquiring them despite security being their main argument for why they should be in charge in the first place.

Re: Rubygems.org AWS Root Access Event – September 2025

#97

Post by andrewmcwatters »

RhythmFox wrote: post #71
andrewmcwatters wrote: post #11

Ethical and legal boundaries? RubyGems Privacy Notice already tells you that they share information with a number of large firms and notably ClickHouse... for "Customer Data Processing." All this proposal does is request from one of the maintainers/on-call providers? another entry in this Privacy Notice as a part of a payment deal. This is a mess, but it also unnecessary smears both sides. It calls out that RubyCentr…

[flagged]

I think the point being that whatever was going on with access controls here was blatant gross negligence, because what is this guy doing with access who doesn't literally own the organization or the intellectual property?

Set that aside, which obviously stinks, but then why is said obviously incompetent organization sharing confidential corporate emails with the public, saying this guy proposing a corporate data access plan in exchange for consulting fees is crossing "ethical and legal boundaries?"

Are you serious? This reeks of someone or a number of people who have no idea what they're doing. Have these people never worked with a business before? Never spoken with a software firm? A marketing firm? Any consultancy whatsoever?

Who owns the registry? What is going on here? This is insane.

It makes the entire Ruby ecosystem look like it's run by children.

Re: Rubygems.org AWS Root Access Event – September 2025

#98

Post by tptacek »

ctoth wrote: post #38

AWS account root access on a language package registry for 11 days. Not EC2 root - AWS account root. Complete control over IAM, S3, CloudTrail, every-damn-thing. They're claiming "no evidence of compromise" based on CloudTrail logs that AWS root could have deleted or modified. They even admit they "Enabled AWS CloudTrail" after regaining control - meaning CloudTrail wasn't running during the compromise window. You ca…

Isn't the subtext of this post pretty clearly that the unauthorized actor was Andre Arko, who had until days prior all the same access to RubyGems.org already?

The impression I have reading this is that they're going out of their way to make it clear they believe it was him, but aren't naming him because doing so would be accusing him of a criminal act.

Re: Rubygems.org AWS Root Access Event – September 2025

#99

Post by phoronixrly »

Imustaskforhelp wrote: post #31
zrail wrote: post #29

Earlier quoted context omitted.

The problem, as with every package manager, is transitive dependencies. It's all well and good to set up direct dependencies to only pull from git repositories, but bundler still needs a way to resolve those gems' dependencies. You could pre-resolve every dependency in your chain to a git repository, even to a fork under your own control, but that will end up being a maintenance nightmare.

Can't a middle compromise happen as it happens in something like golang? Can some vps/serverless provider not do this like fly.io as an recent example with kurt got got? or hetzner? I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/o…

> I think that golang's model can actually be sort of cheaper/ more cost effective for servers as compared to how ruby might be doing it right now and so cheaper might mean that a new non profit can be created which can work on less money/outside funding/drama overall

It also means no code signing and the natural capture of most of the ecosystem by Microsoft (due to devs preferring to host their code on github, a bundler that lacks package hosting will be entirely at the whim of MS)

Re: Rubygems.org AWS Root Access Event – September 2025

#100

Post by krowek »

mikey_p wrote: post #40
terracatta wrote: post #3

That email screenshot is pretty bad for Arko. It clearly shows intent to sell PII data to a third party during a time when Ruby Central had diminished funds and needed help affording basic services. What the fuck.

Why do they need money? What happened to their funding?

One of the major sources of funding was cut because they sided with the devil...
Post reply on HN