31 ms·

Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover

• leakycap 1y ago
  I wasn't expecting such a nice writeup. Worth a read. The Ruby community has been eating itself alive since almost the beginning, but it is sad to see the short-sighted destruction of trust and connection that this has had.
  • bradgessler 1y ago
    How has it been “eating itself alive”?
    • leakycap 1y ago
      Ruby promised programmer happiness and delivered programmer warfare. Predating the current hostile takeover: •••the vitriol directed at early critics like Zed Shaw •••mysterious departure of _why the lucky stiff •••the contentious Code of Conduct •••DHH •••uneasy truce after the toxic tribalism of the Rails vs. Merb There's more, but the linked article can send you down more interesting rabbit holes than more bullets on my list
      • bradgessler 1y ago
        There’s been a ton of that, yes, but for most people who are building applications and websites with Ruby, it’s been stable, productive, and prosperous.
        • leakycap 1y ago
          > How has it been “eating itself alive”? > There's been a ton of that, yes... What are you saying - because some people got rich off Ruby, it's OK that those things happened? Clearly not - Ruby will be lucky to have a shadow of the community left after this.
          • bradgessler 1y ago
            No, I'm saying there's a lot of people who won't even know this happened. Fewer will know that it happened, but they'll view it as a scenario where the ends justify the means. I'm on the record saying RC did a poor job rolling out these changes and treated the maintainers poorly. There will be a lot of amazing Rubyists that leave, which is terrible, but it won't be "the shadow of a community left" because there's way too many people who depend on it to feed their families.
            • leakycap 1y ago
              > No, I'm saying there's a lot of people who won't even know this happened. In the world of "I'm sorry to that man" this seems like a given about literally everything. Not knowing something happened is called being uninformed, and it doesn't change things or make the person right just because they don't know about something that occurred. > There will be a lot of amazing Rubyists that leave We agree. Listen, WebObjects still has a somewhat active community. Ruby's community won't be helped by recent events, but recent events happened because the Ruby community has been backstabby for a long time and no one has stopped it because there's too much money to be made in the meantime to care about things like people.
          • chao- 1y ago
            >Ruby will be lucky to have a shadow of the community left after this. Maybe? This feels like an extreme statement with too much certainty at this point.
        • 827a 1y ago
          Ruby's status of having, like, two companies that are big and known to use Ruby (Shopify and 37Signals) is the reason why this was allowed to happen (three if you include Github, but my understanding is that its used less-and-less there). I have doubts that anyone could name another company or group most people have heard of using Ruby in any significant capacity. Its a dying language that does not have the legs to survive this drama.
          • WA9ACE 1y ago
            Stripe, AirBnB, Instacart, Zendesk, Kickstarter, Mastodon, and if I remember right Coinbase was originally Rails as well.
            • gleenn 1y ago
              Twitter also
              • mvdtnz 1y ago
                Twitter famously eliminated as much ruby as practical from their codebase.
                • pessimizer 1y ago
                  Had to kill the failwhale.
            • 827a 1y ago
              Many if not all of these companies are, to my knowledge, companies like Github which might still have some legacy parts of their system running Ruby, but aren't building significant new code in Ruby; and if they do have Ruby, are trying to reduce its prevalence in their system.
              • 3by7 1y ago
                You're badly misinformed (or are intentionally spreading misinformation).
      • insane_dreamer 1y ago
        _why's departure had nothing to do with the Ruby community, as far as we know (unless some new info has come to light recently) Zed Shaw, sure, but that's a single person (though a very vocal one; I always liked his work, but he was pretty outspoken and that got under people's skin) DHH - yes, opinionated to a fault and outspoken like ZS, prone to create division, but that was always more about Rails than Ruby (this is not a comment on DHH recently, which I know nothing about; I stopped being active in Ruby/Rails community over a dozen years ago). Rails vs Merb - again I think you're conflating the Rails community with the Ruby community
        • leakycap 1y ago
          If you don't realize the overlap in the Rails and Ruby on Rails community, I'm not sure what corner of the Ruby world you've been hiding in. Someone can shush away any behavior if they want, like you have done. Feel free to provide an alternate history or context for the current Ruby community upheaval if you want, but just dismissing the problems of the past doesn't help anyone.
          • insane_dreamer 1y ago
            I'm not dismissing the problems of the past. I just don't think they were as big problems as you make them out to be. It's not like I wasn't around or unaware, I just didn't let it bother me - and was happy with how things were developing despite some arguments around the fringes as in any community. > I'm not sure what corner of the Ruby world you've been hiding in. I did say that I haven't been involved for the past dozen years. Before that I was definitely there when Rails burst onto the Ruby scene and its early years. I realize the overlap but they were still pretty distinct -- though maybe that's changed in the past decade.
            • leakycap 1y ago
              "it didn't affect me so I didn't care" is a common and valid feeling up until you are aware of what is happening I developed with Ruby from the beginning and loved Ruby on Rails for many reasons. The community's backstabbing nature and callousness toward people who put a lot of work in was not something I ever admired and it's led us here.
      • jamesgeck0 1y ago
        DHH aside, most of this drama was over a decade ago.
        • leakycap 1y ago
          "Actually, the Ruby community ripped itself apart a decade ago and has never changed and still suffering from the consequences except with the recent thing with the founder" is not a strong argument
          • tyre 1y ago
            No, but listing things that happened over the course of over a decade, some of which are well resolved and others (like why’s leaving) are questionable how they’re an indication of drama. He left public programming, including Scratch, entirely.
            • leakycap 1y ago
              > things that happened over the course of over a decade Bad things happening to contributors year after year for a decade shows a toxic community that doesn't change even over a long period of time The latest harm is just the continuation of what has been happening since the beginning > some of which are well resolved Resolved? Decisions were made, but the tensions were never resolved and people were hurt. > He left public programming [...] entirely. Yeah. That's what happens when someone is destroyed after years of their hard work is treated like nothing.
        • sanderjd 1y ago
          Ha yep. I remember a lot of this drama from my early days working with rails. But my impression is that none of this mattered and has long been water under the bridge. (I didn't know until reading about this current episode that there is new DHH drama.)
      • foysavas 1y ago
        I wrote a book on Merb and was an active contributor. Before that I had developed several apps with Rails. That said, the Rails vs Merb era was mostly good natured competition and I don't view the Rails vs Merb period as itself having been problematic. Merb devs believed we could make app development both simple to start (as a single file like Sinatra) and easy to evolve (into a modular codebase with Rails-like conventions). Existing outside of the Rails ecosystem allowed Merb to pursue that distinct vision. The Merge between Rails and Merb, accreted many of Merb's modular architectural enhancements to Rails, but sadly deprecated the overall Merb vision. To me that was a shame, but I still wouldn't describe any of it as toxic.
        • leakycap 1y ago
          > I wrote a book on Merb and was an active contributor. It might be a situation where you see it differently because you were involved or benefiting from the way things unfolded > That said, the Rails vs Merb era was mostly good natured competition [...] wouldn't describe any of it as toxic Competition can be healthy, Rails vs Merb was anything but. Quotes from Yehuda himself: ••• "I was just so blinded by tribalism that I never even bothered to check how fundamental the disagreements really were." ••• "waging an all-out war against Ruby on Rails from inside of a company that makes its money selling Ruby on Rails deployment is a pretty bad life strategy" ••• "It's so easy for our brains to turn disagreements about priorities into value conflicts. It takes a lot of effort to see past that mistake." https://yehudakatz.com/2020/02/19/together-the-merb-story/ https://yehudakatz.com/2020/02/19/together-the-merb-story/
          • foysavas 1y ago
            Engine Yard's management took several strategic missteps over the years. One of them was stifling Merb. The quotes from Yehuda describe his difficulty in making the best of a forced merger. Ezra's vision for Merb and DHH's vision for Rails were distinct. Both warranted development. Over time, I assume they would have collectively strengthened the Ruby community. It was a mistake for Engine Yard's management to have instead framed it as zero sum and forced a merger.
      • Trasmatta 1y ago
        > the vitriol directed at early critics like Zed Shaw Zed was also a source of vitriol and toxicity, not just a target
  • hitekker 1y ago
    Eh, it's a messy write-up. The article's stream of consciousness is hard to follow. Too much detail in some areas, not enough in others. It's true Ruby Central was a fiasco and the maintainers should have been treated better. But the author's investigation misses important elements like the "culture war" on both sides. That seems to be prime motivation for everyone involved, given the flames raging in the comments below.
    • leakycap 1y ago
      Your critique of the author's writing style doesn't seem like your strongest argument. > It's true Ruby Central was a fiasco and the maintainers should have been treated better. Treated better as in ... not removed from their own projects? Treated better as in... not kicked out of things they built by someone else who has something to gain? Treated better is not the phrase to describe what should have happened here.
    • dmix 1y ago
      It also skipped over the elephant in the room which is NPM's security issues. This was likely a reaction to a mix of NPM + culture war/deplatforming, where power player got nervous and decided to clamp down on rubygems security to insulate it from hypothetical bad actors.
  • insane_dreamer 1y ago
    > The Ruby community has been eating itself alive since almost the beginning, that's an unfair take; the Ruby community was excellent at the beginning
    • leakycap 1y ago
      Having been there, I don't know what you missed but it sounds like a lot. The project promised a lot in the beginning and some folks new to a language like Ruby were so enthused by what they could do that they didn't pay much attention to the admin drama at the beginning.
      • insane_dreamer 1y ago
        I was there too - I didn't "miss a lot", I just ignored it. The community was still vibrant, helpful, and the language/tools were developing nicely. So some people with big egos (ZS, DHH etc.) were causing waves. Who cares. I don't get swept up in that sort of thing. Not letting it affect you is different from not being aware of it, it just means not getting involved with it. I'm still very happy with Ruby itself, and how it's developed, and Rails too. While I haven't used it professionally in a while, it's still the language I most enjoy working in. I also used it to get my daughter (now finished college and working as a SWE) into programming when she was a child, and currently using it to introduce my 9 yr old son to coding.
        • leakycap 1y ago
          > I didn't "miss a lot", I just ignored it. Yes, so did many others and now it has blown up. > Who cares. I think Ellen Dash, André Arko, Samuel Giddins, Martin Emde, and even Mike McQuaid could be proposed as individuals who care. In addition to the hundreds of people commenting here. > While I haven't used it professionally in a while, it's still the language I most enjoy working in. Perhaps now that you're up to date on some important issues in the Ruby community, you can get involved and help right the ship so the language you love will exist in a few years.
          • 1y ago
  • bdcravens 1y ago
    If the current state of Ruby is "eating itself alive" then I hope it stays hungry.
    • remix2000 1y ago
      What'd Ruby do to you?
      • bdcravens 1y ago
        I should have expanded my response, as I'm happy with the current state of Ruby, and my comment was a poorly executed attempt at sarcasm. :-)
    • tyre 1y ago
      How is this good for anyone? Ruby is an excellent language and the community is largely the best I’ve experienced of any language. Yes there is drama, recently especially, but there have been some fantastic people involved for decades
      • bdcravens 1y ago
        I should have expanded my response, as I'm happy with the current state of Ruby, and my comment was a poorly executed attempt at sarcasm. :-)
    • JeremyNT 1y ago
      There's ruby the tech and there's ruby the community. The former is mature, robust, fit for purpose. The latter is... messy. DHH's prominent role in the ecosystem and full throated endorsement of reactionary politics has alienated a lot of people who might otherwise have been invested in that community, and this latest maneuvering seems downstream of all that. At this point the tension between corporate interests (and by extension DHH, who is a central player in that group) and open source / community interests has become frustratingly high, and it all seems like it could have been avoided. It doesn't mean ruby is dead or even dying, but you can't blame anybody for looking at this and just noping right out over to a community without such drama.
  • scuff3d 1y ago
    I've never written a line of Ruby in my life so this is coming from an outsiders perspective, but after this I don't know how anyone ever works with these people again. I would think the entire community would start finding ways to migrate away. Presumably those repos can be forked, and it sounds like a new source of Gems can be hosted. I doubt it would be easy by any stretch of the imagination, but essentially this entire leadership team just showed themselves to be entirely untrustworthy.
    • sleight42 1y ago
      Spinel's "rv" seems to be just that—obviating Ruby Central.
  • raxxorraxor 1y ago
    I don't know anything about Ruby so forgive my ignorance. As I understand it there were repos required to run the RubyGems Service. This was of interest to major corporate players. Instead of removing the original authors, why didn't they just fork the requirements? And wouldn't that constitute a violation of ownership? Or did the authors wave that away by joining the respective GitHub org in the first place?
    • throwaway346434 1y ago
      Basically, yes. It is murkier as the involvement of some of the original creators in Ruby Central is there, so there are claims to being the original copyright holder applicable to some areas by a very small number of individuals, none of which who are the newly added maintainers, or Ruby Central as a whole entity.
• softwaredoug 1y ago
  > they had a problem with Ruby Central taking control of the RubyGems open source code repositories and gems, which Ruby Central never owned. I don’t quite get how this happened? Ruby Central can’t just reach into my GitHub and declare they own something. Was it under the Ruby central account? Or an org account that decided they “own” the repo?
  • doctorpangloss 1y ago
    It sounds like RubyGems was renamed to Ruby Central.
    • TechIsCool 1y ago
      At the GitHub Enterprise level, you can see that reflected if you look at any of the users profiles https://github.com/mghaught https://github.com/mghaught
  • janpio 1y ago
    That is explained in the "On 9 September, HSBT ..." paragraph, which describes how an existing RubyGems maintainer did - and then undid (most) - changes. A new user remained as an owner of the RubyGems GitHub organization - which allowed Ruby Central to do things later.
  • joeldrapper 1y ago
    I said in the post that HSBT who was a maintainer invited Marty as an owner of the GitHub account. This was against the wishes of the other maintainers who had established practices for adding new maintainers.
    • didibus 1y ago
      So HSBT was the owner? And transfered ownership?
      • joeldrapper 1y ago
        HSBT was a maintainer who had "owner" permissions on GitHub.
• infamouscow 1y ago
  [flagged]
  • apercu 1y ago
    "The cultural hegemony that blue team activists have enjoyed is over, and now those with actual power are finally asserting it and ousting all of the trouble-makers." That's your take? I simply observe lawlessness.
    • infamouscow 1y ago
      Please cite what applicable laws are being violated. I have a hard time believing a company as large as Shopify or others using Ruby will take these actions without first consulting their legal departments. Maybe I'm wrong, but you have to cite an applicable law. Just saying something is lawless doesn't mean it actually is.
      • apercu 1y ago
        So you make a very broad political statement and then your response is specific to Shopify? I very specifically quoted what I responded to.
        • infamouscow 1y ago
          I'm open to alternative perspectives on this matter, but lawlessness isn't a meaningful term, at least in the the USA where this would preside, jurisdictionally. It appears the maintainers involved had a personal or ideological conflict with DHH and overestimated their influence within the project. Their current prominence seems tied to things not unfolding as they hoped. Notably, these maintainers were removed with the stated reason that they were dangerous to the project. There hasn't been evidence or arguments presented to counter this characterization. The reality is that no company wants to deal with this kind of disruption. In the past, ZIRP and tax incentives made such issues tolerable, but those days are over. If their concerns about a hostile takeover were valid, wouldn't the logical response be to stay involved and work to regain influence? Instead, their actions suggest less focus on the project's well-being and more on frustration over contributing significant effort for minimal reward, while using their roles to push personal or political agendas.
• kkaske 1y ago
  I don't follow this kind of thing so forgive my ignorance. Why was "platforming" DHH bad? Honest question.
  • sussmannbaka 1y ago
    He’s been posting increasingly inflammatory articles, for the most recent round refer to https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...
    • DrProtic 1y ago
      I'm sorry but if DHH posted some inflammatory articles maybe it's better to post those articles for people to judge themselves, than to post what someone else thinks.
      • sebastianz 1y ago
        It's the third link on that page, in the first sentence.
  • bakugo 1y ago
    He held the wrong political opinions.
    • 4ndrewl 1y ago
      He's regurgitating racist tropes. Whether he knows that or not I don't know. He might be racist, it might just be Dunning-Kruger around whether he can speak authoritatively on social issues (in his post there's no attempt at original thought, just copy-paste). But...it makes it a little difficult to build an inclusive open source community with that at your head.
    • msie 1y ago
      ‘very fine people on both sides’ - DJT
• bryanlarsen 1y ago
  Given the recent pwnage of part of the npm ecosystem, a panicked overreaction from Shopify & RubyCentral almost seems inevitable.
• sampton 1y ago
  [flagged]
  • craigmcnamara 1y ago
    If that's your opinion I have to assume you only know PHP.
• charcircuit 1y ago
  Owning a source code project doesn't entitle you to admin in the github organization it belongs to, so I don't get why this article keeps hammering that point. Ownership of rubygems doesn't matter as all that's changing is members of a github organization.
• _fat_santa 1y ago
  > Sidekiq withdrew its $250,000/year sponsorship for Ruby Central because they platformed DHH at RailsConf 2025. Honest question: What's the issue with DHH here? What did he do that caused them to pull support because he was platformed at RailsConf?
  • aduty 1y ago
    He has been adopting a more conservative slant and that makes some people irrationally angry.
  • lavela 1y ago
    "The Ruby community has a DHH problem": https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...
    • tbrownaw 1y ago
      Is he known to, like, reference his politics in his conference talks or something?
      • mplewis 1y ago
        Is it ok to put Goebbels on a stage if he isn't talking politics?
        • brigandish 1y ago
          I couldn't care less if Hitler, Stalin, Pol Pot or even Bob Monkhouse[2] were pushing open source patches and contributing talks, as long as they: - do not turn away from debate - do not turn to or espouse violence[1] - and their contributions were of merit Since DHH has done none of that then the answer is "yes, it's okay to put him on a stage to talk about tech". [1] I thank Karl Popper for showing the way here with his Paradox of tolerance. [2] Bob was the master of self-deprecating jokes, I hope he would appreciate that one.
• NoNameProvided 1y ago
  Can somebody provide an archive link? Trying to access the site, I get a Cloudflare security page that says my access has been blocked by some security rules.
  • OptionOfT 1y ago
    https://archive.ph/tg8pQ https://archive.ph/tg8pQ
    • NoNameProvided 1y ago
      Thank you!
  • croes 1y ago
    https://web.archive.org/web/20250923163607/https://joel.drapper.me/p/rubygems-takeover/ https://web.archive.org/web/20250923163607/https://joel.drap...
  • deleted 1y ago
    [deleted]
• dismalaf 1y ago
  [flagged]
  • joeldrapper 1y ago
    I don’t think you read the post. Ruby Central has never owned the source code. They operated a service that had the same name.
    • dismalaf 1y ago
      [flagged]
      • shkkmo 1y ago
        > Anyhow, Ruby Central managed the GitHub repo This is incorrect. The GitHub repository was managed by the maintainers, only some of whom were Ruby Central employees. RubyCentral decided to break the agreement under which those maintainers worked and take control of the repository.
  • sussmannbaka 1y ago
    this article isn’t about rubygems the service and it repeatedly states so
    • dismalaf 1y ago
      If you know anything about the ecosystem you'd know that Ruby Central runs the website/servuce AND maintains the gems, bundler included. Which is why I mentioned both.
• ChrisArchitect 1y ago
  Related: Ruby Central's Attack on RubyGems https://news.ycombinator.com/item?id=45299170 https://news.ycombinator.com/item?id=45299170 A board member's perspective of the RubyGems controversy https://news.ycombinator.com/item?id=45325792 https://news.ycombinator.com/item?id=45325792
• OptionOfT 1y ago
  https://archive.ph/tg8pQ https://archive.ph/tg8pQ
• bhouston 1y ago
  Why were Samuel Giddins and André Arko singled out to be removed? What was their transgressions and to whom? From the write-up it sounds like Shopify wanted them out, but why?
  • janpio 1y ago
    The article has a section about something that might be related: https://joel.drapper.me/p/rubygems-takeover/#rv https://joel.drapper.me/p/rubygems-takeover/#rv
    • bhouston 1y ago
      Quote: > In his blog post, André says, “For the last ten years or so of working on Bundler, I’ve had a wish rattling around: I want a better dependency manager. It doesn’t just manage your gems, it manages your ruby versions, too. It doesn’t just manage your ruby versions, it installs pre-compiled rubies so you don’t have to wait for ruby to compile from source every time. And more than all of that, it makes it completely trivial to run any script or tool written in ruby, even if that script or tool needs a different ruby than your application does.” > Bluesky threads reveal that Rafael França (Shopify / Rails Core) saw this tool as a threat, saying “some of the “admins” even announced publicly many days ago they were launching a competitor tool [rv] and were funding raising for it. I’d not trust the system to such “admin”.” So a dev was innovating to make better tool to meet their needs (which is what most open source maintainers are generally doing all day), and then some guys immediately jumped to the possibility that they would then actively sabotage RubyGems? Whoa, that is insane. Trying to kill innovation and a start-up out of fear doesn't sound like Shopify's branding in the media.
      • ZhadruOmjar 1y ago
        At some point the majority will learn that no matter the public messaging most large companies will do what benefits their incumbency over what is best for the industry or customers.
        • 1y ago
• dang 1y ago
  Related. Others? (most recent first:) An Update from Ruby Central - https://news.ycombinator.com/item?id=45344448 https://news.ycombinator.com/item?id=45344448 - Sept 2025 (1 comment) A board member's perspective of the RubyGems controversy - https://news.ycombinator.com/item?id=45325792 https://news.ycombinator.com/item?id=45325792 - Sept 2025 (148 comments) Goodbye, RubyGems - https://news.ycombinator.com/item?id=45306135 https://news.ycombinator.com/item?id=45306135 - Sept 2025 (1 comment) Ruby Central's response to the RubyGems situation - https://news.ycombinator.com/item?id=45301949 https://news.ycombinator.com/item?id=45301949 - Sept 2025 (1 comment) Ruby Central's Attack on RubyGems [pdf] - https://news.ycombinator.com/item?id=45299170 https://news.ycombinator.com/item?id=45299170 - Sept 2025 (244 comments)
• richardlblair 1y ago
  I get that when drama unfolds like this there is going to be a shake out. It's always valuable, to some degree, to know what happened and why. I just wish we could get to the part where the community can know and trust that our supply chain is safe and can be trusted.
  • evolve2k 1y ago
    Part of the long term supply chain question is that you trust who’s in charge. This corporate takeover of Ruby central and now Ruby gems is deeply concerning for the state of the Ruby ecosystem. Meanwhile the Ruby core team is in Japan, would you like them to report in for work orders to shopify too?
  • tbrownaw 1y ago
    > know and trust that our supply chain is safe and can be trusted. I'd actually think stuff like that recent npm worm would be a bigger danger than whatever this mess is?
• didibus 1y ago
  I understand Ruby Central doesn't own the source code, it's open source, and that they own the service, but who owned the GitHub account/repo ? Who created it originally?
  • riffraff 1y ago
    The same people who created ruby central write the first versions of rubygems iirc (David Black , Chad Fowlernetc). But that was a long time ago and I'm not sure it matters to the current kerfuffle.
    • zem 1y ago
      > David Black now there's a name I haven't heard in a while! he was definitely one of the prominent people keeping the ruby mailing list fun and friendly back in the day; I miss that early ruby era where everyone was enthusiastic about how nice the language felt to use.
      • sleight42 1y ago
        Yep. I think he retired in the late 00's. Lovely guy.
    • didibus 1y ago
      > and I'm not sure it matters to the current kerfuffle I guess I find it a bit strange that it's so fuzzy who owned the GitHub repo. So it was owned by a GitHub organization, and someone should have owned that organization no? Maybe the person that created it initially? You can have more than one person with a role that allows to change ownership of repos owned by an organization, was that the situation here? Did multiple people had that permission and one of them re-owned the repo to themselves without any other knowing? I say that because, I don't normally consider every code contributor to a repo, or even admin the owner of a repo. If I create an open source lib, and then create a GitHub repo for it, and contributors come in, to help commit code, do PRs and even manage the repo, and later I decide to revoke everyone else's access, as the owner, like it's fine. Sure maybe some of the admins might wonder what's up, why I don't trust them administering the repo anymore, but it's my repo. Here I'm struggling to identify whose repo is it? And was the repo owner kicked out of their own repo, so this is a takeover? Or did the owner just kick out others ?
• phaedryx 1y ago
  This is my understanding: 1. Ruby Central hosts, maintains, and sponsors Rubygems and Bundler 2. Based on recent events, it was possible that credentials were stolen (https://www.bleepingcomputer.com/news/security/60-malicious-ruby-gems-downloaded-275-000-times-steal-credentials/ https://www.bleepingcomputer.com/news/security/60-malicious-...) 3. They decided to lock everyone out until security issues could be resolved It makes sense to me from a security standpoint, but their communication has been terrible which has led to a lot of speculation.
  • shkkmo 1y ago
    Incorrect. Ruby Central hosts the RubyGems service, not the RubyGems repository. Ruby Central employs some RubyGems maintainers but does not own the repository. Ruby Central decided to make their employees who are maintainers take over the repository against the wishes of the other maintainers so they could remove some of the maintainers from the project.
• deleted 1y ago
  [deleted]
• deleted 1y ago
  [deleted]
• watwut 1y ago
  I dont understand why did Shopify wanted to take control and kick maintenners out?
  • arresin 1y ago
    I’m angry because I thought this was initially heavy handedness on shopify’s part. Instead it’s people abusing the trust and power they have to try and cancel DHH because they don’t agree with him about some things. Absolutely sickens me to see the cancellation in motion. Completely bigoted and self righteous behaviour.
    • thr0wawayt0day 1y ago
      The moment I saw Arko's name I knew what this was about, the petty culture war that some in the Ruby community engage in, and I was right. My only surprise is that something is finally being done.
      • gnabgib 1y ago
        Knew what it was about, created an hn account, and made this comment?
  • mrguyorama 1y ago
    DHH is part of shopify's board currently apparently.
• 827a 1y ago
  > To strengthen supply chain security, we are taking important steps to ensure that administrative access to the RubyGems.org, RubyGems, and Bundler is securely managed. Ridiculously bold to say when what happened here was literally a malicious supply chain attack.
  • jonny_eh 1y ago
    Malicious how? Was malicious code inserted? Serious question.
    • 827a 1y ago
      Status quo administrators had their access revoked without their consent and without cause. That's malice.
      • jonny_eh 1y ago
        That sounds more like "unfair" or "theft", not malice. Malice implies some kind of intent to harm or injure.
        • whizzter 1y ago
          If money makes them do things like this, what's stopping them from bundling Bonzi Buddy if Shopify is bought out by PE and starts cutting funding to "useless" stuff? (Yes, it's a hyperbolic example)
      • rurban 1y ago
        It's more like a hostile takeover
• thrownaway561 1y ago
  if it wasn't for DHH, Ruby would be a hobby programming language at best. The community can say what it wants, but it and frankly, most of the web programmers in the world, owe DHH some thanks. If it weren't for him, Yehuda Katz and John Resig, 90% of the web would still be written with Perl, CGI and VBScript.
  • int_19h 1y ago
    90% of the web is written in PHP, and Rails didn't change that.
  • mhd 1y ago
    Don’t threaten me with a good time.
• JohnBooty 1y ago
  This is a great account of "what." I'm still struggling to understand the "why." (That's not an implicit criticism of the article, which is extremely appreciated because it's neutral and factual) I've been away from Ruby for a few years but Shopify always seemed like a huge net positive, sponsoring lots of valuable work on both Ruby and Rails. I never followed Ruby community happenings very closely but I'm not aware of negative feelings towards their community role in the past.
  • tyre 1y ago
    Plus one. Reading through this, I’m not sure what the fear is of Shopify taking a larger role. They’ve been strong contributors to Ruby for a really long time. Not that I agree with the actions, but I can’t parse what nefarious motives they might have from this article.
    • LightBug1 1y ago
      Aren't they a profit motivated company? I'm not necessarily saying that's a bad thing. But it inevitably means they will not always be aligned.
      • hibikir 1y ago
        Anon profit, or even a random person, has their own motivations too that will not be aligned. Linus was herding cats in the kernel back when few contributors were paid by corporations to do it. Anyone that has spent any time on a large-ish OSS project has seen bad maintainers with poor incentives, as seen from the outside
        • throwaway290 1y ago
          if there are contributors with various jobs it is very different than if the package is owned by a big for profit
    • Etheryte 1y ago
      Replace Shopfiy with Microsoft, Oracle or etc and surely you can see what worries people might have around a move like this. Just because a company has a positive imago does not mean that their motives align with that of the community.
• xaxaxa123 1y ago
  shut down Ruby Central, if not, they will make gems and bundler a payed servive.
• mtlynch 1y ago
  >Sidekiq withdrew its $250,000/year sponsorship for Ruby Central Whoa! I'm blown away that Sidekiq has enough money in the bank that one of their sponsorships is $250k/yr! Sidekiq the company (actually ContribSys) is just one guy: Mike Perham.[0] I listened to an interview with Mike a few years ago, and he seemed like he had an amazing setup. He was making about $1M/yr with no employees, just him selling code and contributing to open-source. I don't think he even has servers to keep online. According to this podcast from 2023, he's now making close to $10M/yr in revenue and is still just running the whole thing by himself.[0] Great life for a solo dev founder! [0] https://ruby.social/@getajobmike https://ruby.social/@getajobmike [1] https://www.startupsfortherestofus.com/episodes/episode-661-millions-in-revenue-as-a-one-person-software-company https://www.startupsfortherestofus.com/episodes/episode-661-...
  • kimos 1y ago
    Mike is salt of the earth, a wonderful man. The community is lucky to have him. I also of course did not know the size of his donation, but it’s not that surprising. Especially since he didn’t advertise his reason for donating, or his reason for stopping (both of which are principled).
    • BowBun 1y ago
      Seconding this. No-nonsense, good dude. Shaking his hand was more of a personal goal than DHH.
    • jaredcwhite 1y ago
      I can concur, I have spent some time with him IRL. He is one standup guy, and his ethics are inspiring.
  • deleted 1y ago
    [deleted]
  • deleted 1y ago
    [deleted]
  • mperham 1y ago
• LightBug1 1y ago
  Just read DHH's Sept 15th Heyworld post ... what an absolute sh1t spiral ... it reads like someone who's bubble of information has defeated them. Is that what getting old looks like? .... terrifying .... he sounds like the wanker corner of our local pub .. the only difference is he has the platform and money to amplify his semi-drunk sounding, ignorant views ... how the mighty have fallen. RIP.
• poorman 1y ago
  I hope this all works out. I remember the day Oracle bought Sun Microsystems and the impact it had on the community and maintainers.
• Aeolun 1y ago
  Maybe just don’t be part of a GitHub organization that can take over your shit if you don’t want them to. We really need a GitHub feature where maintainers can enter an organization but still retain ultimate control over their repository and take it back out if they start being annoying.
  • graypegg 1y ago
    Maintainers could also use that to distrupt things in the same way, to be fair. A two-key-rule system would be neat. A repo can be in an org, but some big changes (removing/adding a maintainer, moving a repo, renaming an org, etc) need to have x of total maintainer accounts click an approve button within a few days of each other. Making big changes slow and tedious feels ideal when we're talking about the countless lifehours sunk into a project by maintainers, that's funded and supported by a company. Both of those parties benefit from cooling off periods and being a bit obstinant to eachother... without being able to slit eachothers throats.
• zem 1y ago
  I wonder if rv will come up with a good packaging story. I maintain one (small, single-author, and not at all popular) gem, and I'm very disinclined to push any new updates to ruby central, but since it's an end-user app I'll be looking for a good language-agnostic way to provide a downloadable version.
• corytheboyd 1y ago
  Damn, you hate to see it. I was skeptical of the hate at first, but this is pretty lame, I take it back and admit to being wrong before.
• Ekaros 1y ago
  This move would make me vary of building on any ecosystem that has too few funders on it. At least if they are call themselves open source communities. If platform is owned by single player from start rules are clear. But if there is only few funding it might come back to bite me. So maybe such cases are bad technology choices. Even if one is not malicious now, it does not tell about future or any decisions they might force through.
• NikolasKyriakou 1y ago
  [dead]
• ycombinatrix 1y ago
  What's the beef between DHH & Sidekiq?