4 ms·

Seems to boil down to "we don't trust Andre[0] and btw Shopify totally didn't make us do this[1]". I still don't understand the mistrust of Andre though. Also,

Seems to boil down to "we don't trust Andre[0] and btw Shopify totally didn't make us do this[1]". I still don't understand the mistrust of Andre though. Also, the second point seems a bit disingenuous when their own board member speaks about a specific deadline[2]. He says it's something they agreed to, so it's necessarily external. That and the teams of reports of other people saying they've heard it's Shopify putting pressure for this specific point makes me look for a higher standard of rebuttal than "dude trust me". Explain why it was urgent. Explain what the deadline was. [0] A recent access review had revealed that many systems were under the control of a single individual, which we determined presented a risk to the security and operational sustainability of those systems. [1] The Board acted independently, and financial support was NOT conditioned on taking these steps. [2] https://apiguy.substack.com/p/a-board-members-perspective-of-the https://apiguy.substack.com/p/a-board-members-perspective-of...

baobun 1y ago
If it was just Andre, what about the several other removed maintainers who were treated equally, except for the recent public hitting on socials? To me it seems A is an easy target to use as distraction for public drama and justification.
- krainboltgreene 1y ago
  The part you're missing is those people really liked André.
mosura 1y ago
What I don’t get is if there is one actor in the Ruby ecosystem that absolutely needs it all to be run in a responsible way it is Shopify, so quite why so many people are concerned about some mysterious back room dealing by Shopify is beyond me. They are not Oracle.
- mijoharas 1y ago
  For me, most people that are involved (e.g. simi, a, now former, maintainer[0]) seem to point to this post by Joel drapper as a canonical and accurate accounting of events, and I have no reason to doubt them[1]. Most of the article says it's due to pressure from Shopify. [0] https://gist.github.com/simi/349d881d16d3d86947945615a47c60ca https://gist.github.com/simi/349d881d16d3d86947945615a47c60c... [1] https://joel.drapper.me/p/rubygems-takeover/ https://joel.drapper.me/p/rubygems-takeover/
  - mosura 1y ago
    Sorry I didn’t mean to express doubt they are behind this. What I don’t understand is why the community are so freaked out by this given the incentives are very much for Shopify to ensure it operates properly.
    - mijoharas 1y ago
      Got it, makes sense, and I agree (and am also kinda confused).
    - skywhopper 1y ago
      Their behavior is at odds with that sentiment, though.
    - munificent 1y ago
      I suspect it's because DHH is on the board of Shopify [1] and a lot of people really don't like him [2]. (To be clear, I am not stating my own opinion of DHH or Shopify. I'm just saying I suspect this is why a lot of Rubyists are not OK with RubyCentral being under the thumb of Shopify.) [1]: https://www.shopify.com/news/david-heinemeier-hansson-board https://www.shopify.com/news/david-heinemeier-hansson-board [2]: https://davidcel.is/articles/rails-needs-new-governance https://davidcel.is/articles/rails-needs-new-governance
- skywhopper 1y ago
  Shopify has plenty of resources to run their own internal, ultra secure Rubygems mirror.
  - zrail 1y ago
    With no insider knowledge whatsoever I can assure you that they do. Large enterprise shops always have these things cached because why take a hard deploy-time external dependency when you can spin up a rubygems (etc) cache backed entirely by your object storage of choice.
    - d4mi3n 1y ago
      Former Shopifolk here. As of 2022 - 2023 they had some private packages in their SCM and an internal Artifactory deployment that was a caching proxy of Rubygems and other upstream dependencies. This may be changed since, but as far as I’m aware many Shopify devs occasionally volunteer time and fixes to Rubygems and related projects from time to time. They certainly have the capacity to run their own full on mirror service, but I doubt they have serious incentive to do so given exciting controls and culture re: Ruby and OSS contributions.
  - kimos 1y ago
    There is no way. Shopify is trying to be part of the Ruby community, because it knows if it becomes the community or bypasses the community, then the community are dead. I think what is most likely is that Shopify is trying to achieve some security goals in rubygems through Ruby Central. That they put a deadline on funding based on some security guarantees. Shopify knows they are a high value target. I bet they thought they could muscle for whatever they want using funding money, and didn’t anticipate the mishandling and then blowback.
    - TehCorwiz 1y ago
      Being a part of the community necessitates that there be a community to be part of. Taking unilateral control is not being part of a community.
- justinclift 1y ago
  Sometimes organisations that are given near veto power over a Community Thing will bend that Thing to be self serving of themselves. Red Hat -> IBM -> CentOS is an example of this to me.

baobun 1y ago

If it was just Andre, what about the several other removed maintainers who were treated equally, except for the recent public hitting on socials? To me it seems A is an easy target to use as distraction for public drama and justification.

krainboltgreene 1y ago
The part you're missing is those people really liked André.

mosura 1y ago

What I don’t get is if there is one actor in the Ruby ecosystem that absolutely needs it all to be run in a responsible way it is Shopify, so quite why so many people are concerned about some mysterious back room dealing by Shopify is beyond me. They are not Oracle.

mijoharas 1y ago
For me, most people that are involved (e.g. simi, a, now former, maintainer[0]) seem to point to this post by Joel drapper as a canonical and accurate accounting of events, and I have no reason to doubt them[1]. Most of the article says it's due to pressure from Shopify. [0] https://gist.github.com/simi/349d881d16d3d86947945615a47c60ca https://gist.github.com/simi/349d881d16d3d86947945615a47c60c... [1] https://joel.drapper.me/p/rubygems-takeover/ https://joel.drapper.me/p/rubygems-takeover/
- mosura 1y ago
  Sorry I didn’t mean to express doubt they are behind this. What I don’t understand is why the community are so freaked out by this given the incentives are very much for Shopify to ensure it operates properly.
  - mijoharas 1y ago
    Got it, makes sense, and I agree (and am also kinda confused).
  - skywhopper 1y ago
    Their behavior is at odds with that sentiment, though.
  - munificent 1y ago
    I suspect it's because DHH is on the board of Shopify [1] and a lot of people really don't like him [2]. (To be clear, I am not stating my own opinion of DHH or Shopify. I'm just saying I suspect this is why a lot of Rubyists are not OK with RubyCentral being under the thumb of Shopify.) [1]: https://www.shopify.com/news/david-heinemeier-hansson-board https://www.shopify.com/news/david-heinemeier-hansson-board [2]: https://davidcel.is/articles/rails-needs-new-governance https://davidcel.is/articles/rails-needs-new-governance
skywhopper 1y ago
Shopify has plenty of resources to run their own internal, ultra secure Rubygems mirror.
- zrail 1y ago
  With no insider knowledge whatsoever I can assure you that they do. Large enterprise shops always have these things cached because why take a hard deploy-time external dependency when you can spin up a rubygems (etc) cache backed entirely by your object storage of choice.
  - d4mi3n 1y ago
    Former Shopifolk here. As of 2022 - 2023 they had some private packages in their SCM and an internal Artifactory deployment that was a caching proxy of Rubygems and other upstream dependencies. This may be changed since, but as far as I’m aware many Shopify devs occasionally volunteer time and fixes to Rubygems and related projects from time to time. They certainly have the capacity to run their own full on mirror service, but I doubt they have serious incentive to do so given exciting controls and culture re: Ruby and OSS contributions.
- kimos 1y ago
  There is no way. Shopify is trying to be part of the Ruby community, because it knows if it becomes the community or bypasses the community, then the community are dead. I think what is most likely is that Shopify is trying to achieve some security goals in rubygems through Ruby Central. That they put a deadline on funding based on some security guarantees. Shopify knows they are a high value target. I bet they thought they could muscle for whatever they want using funding money, and didn’t anticipate the mishandling and then blowback.
  - TehCorwiz 1y ago
    Being a part of the community necessitates that there be a community to be part of. Taking unilateral control is not being part of a community.
justinclift 1y ago
Sometimes organisations that are given near veto power over a Community Thing will bend that Thing to be self serving of themselves. Red Hat -> IBM -> CentOS is an example of this to me.