3 ms·

Agreed. I think we have to wait and see how much momentum gem.coop can build. Right now they have promised "things for the future"; they will most likely also

Agreed. I think we have to wait and see how much momentum gem.coop can build. Right now they have promised "things for the future"; they will most likely also deliver eventually. But right now they are not there. If and when they open beta, though, I'll begin to republish my old gems (not all, some I merged into other gems but most of the core stuff will be back) there. They have some things they should improve on though - documentation (also a problem that ruby doc was separate by the way), namespacing (this is in part also a problem that ruby had no primary way of namespacing; this is also a feature, but it should have a way to separate concerns when possible or wanted). Anyway, I think we'll soon see what happens - I say people should evaluate again in about half a year or so, say like ... end of May 2026. I think this would be a more realistic time frame. I do, however had, also suspect that DHH may become the biggest asset to gem.coop - every further snide remark he does on his blog, will gain new people who are upset, and some of those will eventually help contribute and benefit gem.coop. So for the end user this may be a win-win situation since they can install things how they like it, thus having more flexibility. Many can and will stay with rubygems.org, others may prefer gem.coop, many others will probably use and combine both (this may be a bit more difficult; guess gem.coop needs to think of a way to specify different gem sources on a per-gem basis too. Lots of work to be had for certain).

busterarm 1y ago
Even if you're not an old-timer and don't remember what Ruby Together was like, the AWS root password changing shenanigans, presumably done by Arko, is enough of a red flag that nothing he's associated with has any credibility. No serious business with real (business) customers will accept that kind of risk and gem.coop will never be a thing outside of hobbyists.
- dluan 1y ago
  Read his account of it (https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci...) and you might change your mind (again).
  - busterarm 1y ago
    No, it won't because I can read the timelines and see what he's omitting. He logged in and changed the password after the board emailed him and told him his services were terminated. That includes/specifically mentions his on-call services. His response claims only silence from the board and that he was just performing his on-call duties. I've been a corporate stooge for 25 years or so now. On call duties are one of my main responsibilities. I would NEVER probe out which logins I still have access to after receiving notice of termination. He admits to doing this in multiple places. All his justifications are that he was under contract to do work that he was already notified was terminated. Everything that follows either tells me that he has bad judgment, that he's lying (by omissions), or in the worst case totally delusional. If he was so worried about operational takeover, why did he _change a password_ without notifying anyone else with operational capabilities that he was doing so? Nobody reasonable would _ever_ do that. There's a certain amount of upfront communication and CYA required of reasonable actors in this space and he doesn't have it (Not that Ruby Central did any better). So no, I won't be changing my mind, and I don't know why you put "(again)" in there.
    - florkbork 1y ago
      Notice how this was taking over a GitHub repository from an entire team of maintainers, through deceit; and now we are all a few weeks in and you have seemingly accepted the narrative that this is now one bad apple justifies every action taken before and since, with no questions answered, with a wave of inconsistencies (it's about the money/no, the treasurer is wrong it's not about the money!), etc.
      - busterarm 1y ago
        No, it's not. I haven't weighed in on that at all in this thread. This thread is very specifically about Andre Arko's credibility and the credibility of projects that associate with him. Regardless of what Ruby Central did, his own actions warrant every bit of criticism he's getting. Stop trying to redirect the narrative. There are other threads where that discussion is happening. You can view Ruby Central as being in the wrong all you want and I won't argue with you, but that doesn't mean Arko is not-wrong as well. It's not zero-sum.
- jaredcwhite 1y ago
  Oh I can assure you, it will be a thing.

busterarm 1y ago

Even if you're not an old-timer and don't remember what Ruby Together was like, the AWS root password changing shenanigans, presumably done by Arko, is enough of a red flag that nothing he's associated with has any credibility. No serious business with real (business) customers will accept that kind of risk and gem.coop will never be a thing outside of hobbyists.

dluan 1y ago
Read his account of it (https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci...) and you might change your mind (again).
- busterarm 1y ago
  No, it won't because I can read the timelines and see what he's omitting. He logged in and changed the password after the board emailed him and told him his services were terminated. That includes/specifically mentions his on-call services. His response claims only silence from the board and that he was just performing his on-call duties. I've been a corporate stooge for 25 years or so now. On call duties are one of my main responsibilities. I would NEVER probe out which logins I still have access to after receiving notice of termination. He admits to doing this in multiple places. All his justifications are that he was under contract to do work that he was already notified was terminated. Everything that follows either tells me that he has bad judgment, that he's lying (by omissions), or in the worst case totally delusional. If he was so worried about operational takeover, why did he _change a password_ without notifying anyone else with operational capabilities that he was doing so? Nobody reasonable would _ever_ do that. There's a certain amount of upfront communication and CYA required of reasonable actors in this space and he doesn't have it (Not that Ruby Central did any better). So no, I won't be changing my mind, and I don't know why you put "(again)" in there.
  - florkbork 1y ago
    Notice how this was taking over a GitHub repository from an entire team of maintainers, through deceit; and now we are all a few weeks in and you have seemingly accepted the narrative that this is now one bad apple justifies every action taken before and since, with no questions answered, with a wave of inconsistencies (it's about the money/no, the treasurer is wrong it's not about the money!), etc.
    - busterarm 1y ago
      No, it's not. I haven't weighed in on that at all in this thread. This thread is very specifically about Andre Arko's credibility and the credibility of projects that associate with him. Regardless of what Ruby Central did, his own actions warrant every bit of criticism he's getting. Stop trying to redirect the narrative. There are other threads where that discussion is happening. You can view Ruby Central as being in the wrong all you want and I won't argue with you, but that doesn't mean Arko is not-wrong as well. It's not zero-sum.
jaredcwhite 1y ago
Oh I can assure you, it will be a thing.