Ruby Central's Attack on RubyGems [pdf]

https://pup-e.com/goodbye-rubygems.pdf

by jolux • 10 months ago

710 178 10 months ago

pup-e.com

Alifatisk2• 10 months ago

So Ruby Central did a hostile takeover of RubyGems enterprise account in GH. Wow

jhealy• 10 months ago

Lio• 10 months ago

Ruby Central really need to come out and explain what they are doing here.

At the least this looks like a very destructive and poorly communicated move.

hu3• 10 months ago

Copy-pasted below for posterity in case it goes down because I think this is a huge deal:

## Ruby Central’s Attack on RubyGems

Hi! I’m Ellen, but you probably know me as duckinator or puppy.

I really wish I didn’t have to write this, but I feel the Ruby community needs to know it.

I have been part of the Ruby community since I was 13, and one of the RubyGems maintainers for the last decade.

This community has helped me through very hard times, and you mean the world to me.

One of the most important lessons I learned from y’all is this:

A person’s character is determined not only by their actions,
but also the actions they stay silent while witnessing.

## This Month Has Been A Fuck Of A Year

This is what unfolded between September 9 2025 and September 19 2025, as I understand it.

On September 9th, with no warning or communication, a RubyGems maintainer unilaterally:

renamed the “RubyGems” GitHub enterprise to “Ruby Central”, added non-maintainer Marty Haught of Ruby Central, and removed every other maintainer of the RubyGems project.

He refused to revert these changes, saying he would need permission from Marty to do so.

On September 15th, this maintainer said he restored the previous permissions after talking with Marty. Marty stated the deletion was a “mistake” and “should never have happened”.

The “restoration” kept a notable change: Marty was now an owner of the GitHub enterprise.

The RubyGems team responded by immediately began putting in place an overdue official governance policy, inspired by Homebrew’s.

On September 18th, with no explanation, Marty Haught revoked GitHub organization membership for all admins on the RubyGems, Bundler, and RubyGems.org maintainer teams.

By doing this, he took control for himself and other full-time employees of Ruby Central.

Later that day, after refusing to restore GitHub permissions, Ruby Central further revoked access to the bundler and rubygems-update gems on RubyGems.org

I will not mince words here: This was a hostile takeover.

## My Stance On This

I consider Ruby Central’s behavior a threat to the Ruby community as a whole.

The forceful removal of those who maintained RubyGems and Bundler for over a decade is inherently a hostile action. Ruby Central crossed a line by doing this.

When called out, these changes were mostly reverted. Then, it was done again.

By crossing that line a second time after being called out for it, Ruby Central has made it extremely clear to me that they are not engaging in good faith.

Ruby Central’s behavior has forced my hand. I refuse to watch this without speaking up.

I am resigning from my position at Ruby Central, effective immediately.

To remove any doubt: Ruby Central unilaterally, with no explanation, revoked all access to RubyGems against both my wishes and the wishes of the entire RubyGems team.

Ellen Dash (@duckinator)

September 19, 2025

ethagnawl• 10 months ago

https://web.archive.org/web/20250919130055/https://pup-e.com...

drbragg3• 10 months ago

Ruby Central's whole thing is they maintain, develop, and secure bundler and ruby gems. Marty was previously a lead at Ruby Central and recently came back to RC as their Open Source Lead. It sounds like there was a clusterfuck getting the repo switched over but I'm not seeing how this is an attack on Ruby gems. Am I missing something?

krmbzds4• 10 months ago

Your comment reminds me of this video: https://youtu.be/R3gef1Wn9BE

woodruffw2• 10 months ago

I think the missing piece here is that almost every person publicly involved with RubyGems’ development has left the project in recent weeks. I don’t have any special insight here, but from an outsider’s perspective it seems as through Ruby Central is trying to turn a former “host” relationship into a “control” relationship.

nevinera3• 10 months ago

I think you're right, but I suspect the root here is one of legal liability - if rubycentral is operating as a nonprofit that hosts _a recurring attack vector on other companies_, they'll have legal obligations to secure that service against those attacks. I assume they are continuously deploying out of that repository, and took the simplest route to controlling the attack vectors?

I'm not sure how anyone familiar with open-source communities would fail to predict the backlash though. They really should have forked the repository and switched the deployments over to their downstream fork (if I'm right about the root cause here).

(I'm mostly thinking in terms of supply-chain attacks, like this one: https://blog.rubygems.org/2025/08/25/rubygems-security-respo...)

sideofbacon• 10 months ago

Who? Everyone I recognize is continuing to contribute. https://github.com/rubygems/rubygems/graphs/contributors?fro...

eutropia• 10 months ago

Could someone with more insight as to the decision-making at Ruby Central weigh in on what's going on here? Between this and drama with the conferences over the years I'm just confused. They've been busy launching podcasts and doing fundraising, email campaigns and all that. Has there been a change in leadership?

swilk001• 10 months ago

Yes, they recently hired a new Executive Director.

bradgessler4• 10 months ago

Links:

https://rubycentral.org/news/reflections-on-railsconf-2025-f...

https://www.linkedin.com/in/shancureton

brightball• 10 months ago

I'm still not clear about why they dropped RailsConf. I assume the biggest sponsors threw their weight behind Rails World?

projectazorian• 10 months ago

It feels like funding for conference participation at US companies has plummeted since COVID. Pre-COVID, most engineers I worked with would attend at least one conference a year on the company’s dime. That’s now become uncommon for anyone below staff engineer or director level, at the places where I work anyway.

JBiserkov• 10 months ago

jmuguy2• 10 months ago

I know its against the content policy on HN but I really wish I could reply with that gif from Veep where she's nervously laughing while mouthing "what the fuck".

Seriously... wtf.

robin_reala2• 10 months ago

Looks like Homebrew are mediating in some capacity: https://bsky.app/profile/mikemcquaid.com/post/3lz6pkabzwk2o

politelemon• 10 months ago

Why is homebrew involved in this?

robin_reala2• 10 months ago

Homebrew is one of the most developer-visible Ruby projects around.

dcchambers2• 10 months ago

It's not. The lead maintainer of Homebrew (Mike McQuaid) is helping to mediate the conversation between the parties, per his own post.

Has nothing specifically to do with Homebrew.

mikemcquaid4• 10 months ago

Not Homebrew, yes me. Just trying to mediate and meeting with as many people on both sides (past and present) as possible.

krmbzds4• 10 months ago

The recent actions taken by Ruby Central - removing long-time RubyGems and Bundler maintainers without warning, seizing administrative access, and consolidating control under a small, centralized group - represent a serious breach of trust within the Ruby ecosystem.

This was not a misunderstanding. It was a hostile takeover of key infrastructure, undermining both the long-standing maintainers and the broader community that relies on RubyGems and Bundler every day.

The Ruby ecosystem thrives on collaboration, openness, and mutual respect. What we've witnessed over the past week violates those principles. Ruby Central's actions - unilateral access revocations, exclusion of experienced volunteers, and refusal to engage in transparent dialogue - are not just organizational missteps. They're a threat to the decentralized and community-driven spirit that has sustained Ruby for decades.

I oppose this power grab.

Even more concerning is the idea that contributor access could become contingent on employment status or ideological alignment. Whether someone is employed by Ruby Central - or holds left-leaning, right-leaning, or apolitical views - should have no bearing on their ability to contribute to open source. Merit, dedication, and community trust must remain the foundation.

If Ruby Central is serious about supporting the Ruby community, they must:

- Immediately restore access to all maintainers removed during this incident.

- Publicly commit to a transparent, community-driven governance model, similar to what the RubyGems team had begun drafting.

- Respect the autonomy of open source maintainers, regardless of whether they are employed by Ruby Central.

- Acknowledge the harm caused by these actions and engage in meaningful dialogue to rebuild trust.

The Ruby community has always been about people - diverse, passionate, and united by a love for a beautiful language. It's time we demand that the institutions claiming to represent us act accordingly.

And if Ruby Central does not do this we must pressure sponsors to stop funding Ruby Central and ultimately; if all else fails, we must build and maintain our own infrastructure unencumbered by these shenanigans. Also, in order to re-establish trust in the community; the people responsible for causing this ruckus should be fired.

Ruby-Level Sponsors (Top Tier): Alpha Omega, Shopify, Sidekiq

Gold-Level Sponsor Flagrant

Silver-Level Sponsors: Cedarcode, DNSimple, Fastly, Gusto, Honeybadger, Sentry

armchairhacker• 10 months ago

Even more concerning is the idea that contributor access could become contingent on employment status or ideological alignment. Whether someone is employed by Ruby Central - or holds left-leaning, right-leaning, or apolitical views - should have no bearing on their ability to contribute to open source. Merit, dedication, and community trust must remain the foundation.

Is there any evidence of this? It's not in the PDF.

Also, this comment is clearly AI and more importantly, it affects the quality. Ex: "It's time we demand that the institutions claiming to represent us act accordingly." It seems "the institutions" have been representing them fine until now, why "it's time"? "This was not a misunderstanding. It was a hostile takeover"..."This was a hostile takeover" (or "is", it's still ongoing). "The recent actions taken by Ruby Central - [list]...Ruby Central's actions - [different list]"...the comment tries to explain what Ruby Central has done and what the maintainers demand, but it's vague and disorganized; the linked PDF is better.

byroot4• 10 months ago

What we've witnessed over the past week

Who is "we"? And what did they witness?

All we got right now is one side of the story.

It is indeed surprising such change wouldn't be immediately followed by a public announcement, but they've been founding and managing RubyGems for a very long time now, so it's not even clear to me how this can be a "takeover".

I'll happily join with my pitchfork if it turns out this is indeed a malevolent move, but until I've read their side of the story, I'd rather wait and see.

Edit: 35 minutes later, here we go: https://rubycentral.org/news/strengthening-the-stewardship-o...

tremon3• 10 months ago

All we got right now is one side of the story

That's because Ruby Central chooses not to communicate. I'm not going to reserve judgment against intentionally mute hostile actors.

bradly• 10 months ago

All we got right now is one side of the story

Well, we have all of Ruby Centrals actions including their action to not be more public during these actions. Their actions are their story. If their actions don't communicate their intent, that is on them to handle that in a professional way to not be in this situation.

simonw6• 10 months ago

Why did you include that list of sponsors at the bottom of your post?

What's with the "contingent on employment status or ideological alignment" bit about? That's not been mentioned anywhere else so far.

Were those parts (or indeed your entire comment) written with the help of an LLM?

UseofWeapons1• 10 months ago

The post is quite clear? They call on the sponsors to stop funding ruby central, and the employment status bit is a clear concern extending from ruby central’s supposed takeover.

Read the post more clearly before accusing someone of LLM usage. And even if it is, they are still valid points to be discussed, as opposed to trying to bury it with an LLM accusation.

dragonwriter• 10 months ago

Why did you include that list of sponsors at the bottom of your post?

Clearly, that was because this information directly supports readers following through on the call to action: “And if Ruby Central does not do this we must pressure sponsors to stop funding Ruby Central”. That’s obvious.

What's with the "contingent on employment status or ideological alignment" bit about? That's not been mentioned anywhere else so far.

Yes, both the original pdf and the RubyCentral statement edplicitly refer to admin status being made contingent on being full-time employee of RubyCentral. If you just mean no one has explicitly brought upthe ideological angle, well, that’s a fairly easy concer to reach wrih something being contingent on employment at a particular nonprofit, so it would be weird to interogate like this even if you had clearly focussed on kn just that point.

angoragoats2• 10 months ago

Why did you include that list of sponsors at the bottom of your post?

The paragraph immediately preceding the list begins with a sentence mentioning the sponsors. How did you not see this?

What's with the "contingent on employment status or ideological alignment" bit about? That's not been mentioned anywhere else so far.

“not been mentioned anywhere else” is false. If you click on the PDF linked to in this very post it mentions that only full time employees of RubyCentral maintained access to their GitHub account.

I find it ironic that you’re so quick to question whether something is LLM-authored given that you write so much about using LLMs.

type0• 10 months ago

From https://rubycentral.org/news/strengthening-the-stewardship-o...

"Their work laid much of the foundation we are building on today, and we are committed to carrying that legacy forward with the same spirit of openness and collaboration."

what do they mean by openness, it doesn't even say who wrote this

anilgulecha• 10 months ago

Feel bad for the RubyGems community, sending my gratitude and empathy. Ruby was a leap in my career, and i have a soft spot for the language and community

I'll wait for RubyCentral's side on this, but on the face of what's written, these actions do not seem to be transparent or in good faith. Is there something posted from RubyCentral's side?

I wish the Ruby community strength, and a transition over to a community-owned org, one way or another.

(With NPM, WordPress, now this - seems like package repositories are becoming a flashpoint of corporate takeovers..)

thomascountz3• 10 months ago

An update from Ruby Central: Strengthening the Stewardship of RubyGems and Bundler

https://rubycentral.org/news/strengthening-the-stewardship-o...

michaelem• 10 months ago

So uh… “compliance reasons”? That sounds rather concerning.

loloquwowndueo3• 10 months ago

Totally reads like post-facto CYA. they could have communicated this to the maintainers internally beforehand instead of blindsiding them.

downrightmike• 10 months ago

The NPM breach was an email that stated the dev needed to update their MFA by the next day in order to keep their access.

If you're arguing that is what ruby central should have done, that's a social engineering attack.

yxhuvud• 10 months ago

It might have been a good idea to do that communication BEFORE creating all that drama.

raesene9• 10 months ago

If they're trying to strengthen security, this feels like an odd way to go about it.

Making unplanned unexpected changes to GitHub ownership and removing people with lots of experience and institutional knowledge with little notice (based on the original story) and presumably no great hand-over, feels risky and not a great way to improve people's trust in their governance.

jmuguy2• 10 months ago

So essentially they randomly cut off a bunch of long time maintainers for some vague legal and/or security reasons. If there was real reason to do that in a hurry, that's what we need to see, not a corporate PR message.

awilson5454• 10 months ago

100%. I assumed this was inspired by the supply chain attack, but what a horrible way to address this. Reverting it back before revoking it a second time is even more bizarre. Severely mixed messages from leadership, perhaps?

gedy• 10 months ago

It’s not clear to me - did they entirely cut them off, or did they reduce their role as admin of the GitHub org?

If so, I'm not defending it, and I could understand why someone would feel insulted by that - but also get why an org doesn't want too many with elevated privileges.

bradgessler4• 10 months ago

It reads like lawyers and auditors took over RubyCentral.

julik2• 10 months ago

* Get appointed as paid managers of a non-profit * Get advice from legal * Legal suggests removing long-term maintainers without liability contract the same way people get fired: immediately and instantly, and screw the consequences. "Open-source? Never heard of it. Protect your entity legally" * Instantly follow the advice of the lawyers to the letter.

Well done, well done.

blibble3• 10 months ago

it's the professional management class at it again

see: mozilla, nominet (recovered, thankfully)

DannyPage• 10 months ago

We want to express our deep gratitude to the many cohorts of maintainers who have contributed to Bundler and RubyGems over the past two decades. Ruby tooling would not be what it is today without their dedication and leadership. Their work laid much of the foundation we are building on today, and we are committed to carrying that legacy forward with the same spirit of *openness and collaboration*

- The bolded part doesn’t track with locking out the entire team without notice or explanation.

- “Thanks for the hard work, the adults will take it from here” rarely works out.

sussmannbaka• 10 months ago

that’s a lot of words to write “we did a hostile takeover”

thomascountz3• 10 months ago

I think the fear from Ruby Central might have been that, had they communicated openly, a maintainer/community member with admin access could do their own hostile take-over, and that that would expose Ruby Central to some legal liability, if not a complete loss of control.

I'm not in a position where I'd have to make a decision like this, and I don't have all the information, but I like to think that if I had made a decision like this, I'd show some more respect in the aftermath.

Something more akin to: "That was really awful, I'm sorry. We were suddenly faced with the severity of our legal exposure and had to immediately lock everything down. It's not a reflection of trust or anything, it was legally what had to be done. Now that we've taken stock and are now squared away, we have to make a more explicit controls framework, and we hope we can make it up to you, make this right, and have you lead as a maintainer again."

...Then again, maybe this wasn't about legal exposure. Or maybe it was and former contributors/maintainers are getting apologetic emails right now...

loloquwowndueo3• 10 months ago

1. You lock everyone out of the org for whichever valid but idiotic reason. 2. The instant you do, you send them all an email explaining the situation.

That’s how you do it in those cases. You don’t blindside them and then wait for them to react, restore their access back (which totally negated and nullified the “I wanted to preempt a takeover attempt” argument) and continue to skulk around instead of being open about it.

corytheboyd2• 10 months ago

Aren’t supply chain attacks caused by package maintainer accounts being compromised? I suppose too many people with keys to the package repository itself is also liability, but those accounts being compromised just hasn’t been what is happening.

corytheboyd2• 10 months ago

The other side of the story came out, and of course, it’s very reasonable https://apiguy.substack.com/p/a-board-members-perspective-of...

krmbzds4• 10 months ago

We thank the maintainers and respect their legacy.

After removing them without explanation, cutting them off projects they have maintained over a decade and ignoring them when they asked for restoration or dialogue. I feel sad for the maintainers. This is not how they deserve to be treated.

TehCorwiz3• 10 months ago

Moving forward, only engineers employed or contracted by Ruby Central will hold administrative permissions to the RubyGems.org service.

Several of the people removed are employees or contractors of Ruby Central. This doesn't pass the smell test. Not to mention it's post-facto in that they did all of this before notifying anyone.

byroot4• 10 months ago

Several of the people removed are employees or contractors of Ruby Central.

Who?

Not to mention it's post-facto in that they did all of this before notifying anyone.

Isn't that pretty much the number one rule when restricting accesses? First remove accesses, then communicate?

tarellel• 10 months ago

This is just RubyCenteral trying to get ahead of the news and save face before they end up looking like complete @$$ bags.

baggy_trough• 10 months ago

Ruby Central's 'our team' fills me with over-corporate dread. "Organizational Compliance Advisor"? Egads.

https://rubycentral.org/about/

dcchambers2• 10 months ago

Hasn't Ruby Central always 'owned' RubyGems.org, Bundler, and all related infra?

Removing existing maintainers from the project isn't good - and hopefully it's a temporary oversight as Ruby Central gets things set up in the new org. Either bad communication from Ruby Central - or they really did made a bad mistake here (maybe even with the best intentions, given recent NPM issues).

Edit: It seems like there's a lot more to the story here. Many volunteer RubyGems/Bundler maintainers have left because they disagree with decisions that Ruby Central (the nonprofit organization) has made and it seems like all of this is fallout related to that.

tkfu• 10 months ago

Jesus, this is the absolute antithesis of MINASWAN.

afandian• 10 months ago

https://en.wiktionary.org/wiki/MINASWAN

Alifatisk2• 10 months ago

”Initialism of Matz is nice and so we are nice”

chuckadams• 10 months ago

You'll never see anyone writing an acronym of DHHIN...

moritonal• 10 months ago

There's a Q&A to sign-up to next Tuesday here (https://us06web.zoom.us/meeting/register/auIbrbS9RSS7Eukzj7b...).

davidw• 10 months ago

Seems relevant: https://ruby.social/@getajobmike/115231677684734669

I'm just reposting it though. I haven't followed any of this myself.

mijoharas3• 10 months ago

The unstated reason for this change was that many of the existing Rubygems maintainers have recently quit (including their only full-time engineer) due to their continued relationship with DHH.

Can someone expand on what this means? Is it a continued relationship between Ruby Central and DHH, or the maintainers and DHH? Why does the other party have a problem with that?

EDIT: It seems the post was clarified since I copy/pasted this, and it's RC and DHH. Why do the maintainers have a problem with this? I though the stated reason was about RC removing everyone's access with no warning.

mperham• 10 months ago

I clarified the toot.

gizzlon2• 10 months ago

maintainers have recently quit (including their only full-time engineer) due to their continued relationship with DHH.

Ehh, what?! Basically 0 developers in the US have quit as a protest against literal totalitarianism, major and obvious corruption, the end of vaccines (will kill countless) and the end of USAID (already killed.. how many kids?).

But, sure, DHH.. that's where we draw the line!

FFS

Edit: maybe I misunderstood why they quit, quite confused. Still..

Edit 2: Unclear if this has anything to do with DHH? And it turns out I also disagree with some of his views. But, it still stands, he's writing a blog, not literally killing kids. Where's the mass quittings for those people?

jacques_chester2• 10 months ago

At Shopify I was the person who first proposed that we needed to stump up $$$ for RubyGems (and only by implication Ruby Central).

This is not what I had in mind and now I'm embarrassed that I helped make it possible.

choilive• 10 months ago

Sounds like Shopify has some leverage then to open a line of comms with Ruby Central. "Explain yourselves or we will pull funding"

konnorrogers2• 10 months ago

If that's the case, sounds contradictory to their status as a 501c3 and could get their tax exempt status pulled if it's true.

prh82• 10 months ago

The problem is that Shopify is leveraged by DHH (who is on their board) to be the financial support referenced elsewhere in today’s discourse. Shopify is a bad actor here

jacques_chester2• 10 months ago

I should add, to clarify: I don't work at Shopify anymore and I'm not speaking for them. Purely a personal view.

ilikepi2• 10 months ago

There is some more context on a post[1] in /r/ruby, including the fact that the maintainers and others had been working on a proposal[2] for a formalized organizational governance structure as recently as yesterday. The latter also adds some context into Mike McQuaid's involvement: the proposal was influenced by the structure put in place by the Homebrew project.

[1] https://old.reddit.com/r/ruby/comments/1nkzszc/ruby_centrals...

[2] https://github.com/rubygems/rfcs/pull/61

mikemcquaid4• 10 months ago

I'm trying to help, where I can, to mediate. On a call right now about this. Had 4 in the last 24 hours with affected parties past and present on both sides.

I'm not involved beyond just caring a lot about Ruby.

mikemcquaid4• 10 months ago

Posted an update in a thread (or whatever you're meant to call it) on Bluesky: https://bsky.app/profile/mikemcquaid.com/post/3lz7klsyue22f

TL;DR: I've been given a lot of private nuance from both sides here but, even just based how the two sides have treated me personally, it's very hard not to put the blame primarily on RubyCentral. I've been a maintainer on Homebrew for 16 years: it's a hard job. If in doubt: I'll side with maintainers.

esnard• 10 months ago

I know nothing about the Ruby ecosystem, but I really do appreciate that someone cares that much to mediate this mess. Thank you.

swat535• 10 months ago

Also notable reply from DHH:

"Ruby Central has been the RubyGems maintainer and operator since the beginning. They paid people to work on it (including this now disgruntled former contractor).

They're improving their practices and protocols. This is good."

https://x.com/dhh/status/1969168477475786830

knzai2• 10 months ago

A bit of useful context for DHH’s response: he’s had beef with at least one of these maintainers before, and tried to get him removed from stuff.

As André Arko’s employer at his day job at the time, I was tangential to it, so I don’t know all the details, and my memory is imperfect.

But as I understand it, DHH either organized or was part of a group of prominent rubyists who wrote a letter to the Board of Directors of the trade guild (or some other similar unusual non-profit structure) that André had organized to help get funding to support the open source work he and some others did for Ruby infrastructure like Bundler and/or Rubygems. I don’t know the exact terms of the sanctions they sought, but in the end it resulted in his orgs work getting folded into RubyCentral, iirc.

For some reason it seems they disapproved of how André had found a way to get paid for working on open source. He was managing to pay himself and some other people a good wage for part-time open source work. He was even managing to get a bit more diversity involved in it than a lot of Ruby open source infra work typically has (employing a black trans woman SE as part of this). Whatever their actual motivations they disapproved of André founding his own org and running it as he did.

The irony of their most prominent signatory getting rich off open source, via a different less direct avenue of monetization seemed entirely lost on them.

Anyway, I think it blew up in their face and things got settled out into what the status quo of rubygems maintenance was since then.

Now, I’ve heard rumors that perhaps this is actually related. RubyCentral has had a rough few years and DHH has more than a little pull with at least one of their largest funders.

It’d be incredibly petty to do something like dangling funding in front of RC if they’d finish icing out maintainers that he didn’t see eye to eye with. But it would certainly fit the way the events happened. I don’t know anything directly enough to swear by this and wouldn’t want to implicate anyone even if I did.

But I guess look at the known character of the people involved and draw your own conclusions. Does this seem in character to prior behaviors?

ornornor• 10 months ago

I took comfort in the fact that the ruby community seemed miraculously immune from these petty disputes and takeovers from the benevolent entity running the service. Seems like that’s not the case anymore :(

Sorry for all the maintainers, that must suck.

scragz• 10 months ago

I miss the days of "we're nice because matz is nice"

ursuscamp• 10 months ago

I've been a ruby user for almost 15 years. I've been to several RubyConfs in that time. I have never found that to be true. It's a thin veneer over rampant toxicity and political extremism. Many of the evangelists in the Ruby community garnered a horrible reputation outside of Ruby, then migrated to insular social media applications which no one uses, causing the slow and persistent decline in the popularity of the language.

jdminhbg• 10 months ago

A decade ago there used to be a site called rubydrama.org because of how frequently the community blew up at itself.

mijoharas3• 10 months ago

It's often "Mats is nice and so we are nice" and sometimes abbreviated to MINASWAN (which confused me a lot when I didn't remember it)

lavela2• 10 months ago

Welp, so there goes another ecosystem I considered exploring.

What almost surprises me the most, is that such a mature ecosystem still doesn't have a formalized governance structure after all this time. How common is this among large and widely-used open source projects?

teknofobi• 10 months ago

Problem with package managers are they are quite expensive to run, so hard to manage in an otherwise open source ecosystem. There was some controversy around NPM before the GitHub acquisition https://www.businessinsider.com/npm-cofounder-laurie-voss-re..., which I guess is the exact problem a non-profit such as RubyCentral tried to solve.

I would GitHub would be quite well-positioned to set up infrastructure around a fork of RubyGems if things fall apart.

lavela2• 10 months ago

I don't understand yet how that relates to formalizing your decision structures as a group.

I'm sure NPM as a company has some form of decision hierarchy and RubyCentral does as well, but it seems like Ruby Gems doesn't (or didn't). I learned the hard way that writing this down is one of the first thing you should do in any kind of group formation process.

I get that organically grown tech projects don't have that from the start (and that they might not immediately recognize that they're a group at all), but I'd reckoned that an organization of the size of Ruby Gems, with such an importance, would have taken care of that a while ago and I think it's quite irresponsible that they didn't.

morpheuskafka• 10 months ago

For those like me who are not Ruby users/devs, it might be good to explain who exactly Ruby Central is? I assumed they were analogous to Python Soft Foundation or Linux Foundation etc. as the entity of maintainers/owners/whatever of Ruby.

But it seems that they have nothing to do with the ruby-lang.org site where the Ruby binaries itself are distributed. Instead, their own site appears to primarily list them as responsible for organizing an annual conference?

And who owned the RubyGems infrastructure before this takeover? The website (and domain that the client actually calls to get the gems, presumably) seem to have already been part of Ruby Central, so what exactly changed here ownership wise, beyond just kicking the maintainers?

(unrelated -- seeing a mention of DHH here reminded me that I haven't seen anything of the Matt/WP drama in a long time on HN -- time to go Google whatever the resolution of that was)

nomdep3• 10 months ago

Until a few years ago, RubyCentral was very similar to the Python Software Foundation in that it managed all the infrastructure and the main conferences - everything except language development.

A few years ago, RubyCentral lost power when the Rails Foundation was created (most of the Ruby world revolves around Rails). The Rails Foundation organizes its own yearly conference, and RubyCentral stopped hosting theirs.

However, RubyCentral still controls the package management tools and the package registry.

yallcombinator• 10 months ago

sus, inb4 rugpull/verification can

nomdep3• 10 months ago

I can already see the future:

The Rails Foundation will start its own central gem registry and set of forked tools.

Then, RailsCentral will lose its sponsors and fade into irrelevance.

nomdep3• 10 months ago

Nevermind, this tweet (mostly) disproves my prediction:

https://x.com/dhh/status/1969051000867610709

prh82• 10 months ago

Well this is because he has gained more control over RC, which is wise than Rails Foundation starting their own thing

nilslindemann• 10 months ago

Come to Python land, we treat people better.

claudiug• 10 months ago

based on what? I'm both communities and is not 100% like that :)

k33n• 10 months ago

The idea that Ruby Central is "attacking" its own project -- that it has secured funding for -- for a decade plus, is not really based in reality. Not sure what goes on in their "Github Enterprise", but their vanilla github is pretty transparent. Marty has been doing good work in the repo as of late around the Orgs feature. I rely on rubygems.org, and my fork of rubygems.org on a daily basis.

The project is an objective public-good. It's sad that a former employee is attempting to burn it all down. I guess they thought it was all about them and not the millions of DAU's the platform has served without fail since inception. Contractors will come and go.

What are the OPs contributions even? I don't see a single commit from her handle on the 24 month view (below). Correct me if I'm wrong.

https://github.com/rubygems/rubygems.org/graphs/contributors...

blasphemers• 10 months ago

She has some PRs merged in, but nothing that shows me she should have elevated rights in the repo.

https://github.com/rubygems/rubygems/pulls?q=is%3Apr+author%...

jfjjsjdjdjdj• 10 months ago

The idea of a central repository for shared code is great, whether it’s rubygems, rpm, maven central, pypi, crates, packagist, nuget, etc.

But, none of these are a good idea. Any level of centralization leads to disappointment eventually.

mooreds• 10 months ago

I know Marty personally (he helps run the Boulder ruby meetup with me) and I am positive he acted in good faith, even if there were mistakes along the way. I also empathize with the volunteers who were unpleasantly surprised; never a good feeling. I'd encourage everyone to remember that there are people on both sides of the computer screen.

As mentioned in a sibling comment, there's a Q&A with him and other members of Ruby Central on Tue. Here's a link to the signup: https://news.ycombinator.com/item?id=45302629

felipec• 10 months ago

That's what wokeness does to open source projects.

I was banned from the RubyGems project by simply saying "no satisfactory resolution from the development team".

Now woke people are walking away from RubyGems because Ruby Central wants to align with DHH. I say good riddance.

Software should be about technical merit, not ideological agendas.

Ruby Central's Attack on RubyGems [pdf]

Related Stories