6 ms·

This is missing an important part of the story that makes the Ruby Central side look relatively better, which is that one of the existing maintainers offered to

This is missing an important part of the story that makes the Ruby Central side look relatively better, which is that one of the existing maintainers offered to help fill the funding gap in exchange for being allowed to monetize the server logs. https://rubycentral.org/news/rubygems-org-aws-root-access-event-september-2025/#why-did-ruby-central-treat-this-event-as-a-security-incident https://rubycentral.org/news/rubygems-org-aws-root-access-ev...

brigandish 1y ago
That puts the gem.coop repo in a new light.
cyrnel 1y ago
The response to that: https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci...
- ameliaquining 1y ago
  This is about a different part of the controversy, and doesn't respond to the allegation of a monetization proposal.
  - tehryanx 1y ago
    Yes it does. He's refuting that in this part of the post: > When they finally did reply, they seem to have developed some sort of theory that I was interested in “access to PII”, which is entirely false. I have no interest in any PII, commercially or otherwise. As my private email published by Ruby Central demonstrates, my entire proposal was based solely on company-level information, with no information about individuals included in any way. Here’s their response, over three days later.
    - bsammon 1y ago
      A very specific denial. "I didn't propose this specific type of monetization". Would be better if he followed up with "Yes, I proposed monetization, but what I had in mind was this more specific, benign form of monetization:"
saghm 1y ago
Your addition also misses an important part where the only reason he was able to do that was because the servers were forcibly taken from the previous owners for the ostensible purpose of security, but the new regime forgot to change the passwords as part of that. At this point, it's probable that any attempt to just list the pertinent events isn't going to end up being as neutral as one might hope because even the choice of what context to include or exclude is itself editorial. This is the same lesson people might learn in a high school history class, just applied to something much more recent.
- ameliaquining 1y ago
  That's not accurate; the monetization proposal happened before the revocation of permissions. The controversy about various accesses that may or may not have been unauthorized (depending on whose story you believe) came later. Perfect neutrality is unachievable but that doesn't mean that every possible way of presenting the facts is equally valid, or even that it's impossible to distinguish presentations that are or aren't missing important context (see, e.g., the surprising success of Twitter's Community Notes).
- tptacek 1y ago
  Wait, you think the former maintainer breaking into Ruby Central's AWS account and changing its root password makes the former maintainers look better?
  - typpilol 1y ago
    that's the one thing I've heard them not address yet is the changing of the passwords.
    - dismalaf 1y ago
      Arko kind of did address it in his most recent blog post. He claims he was doing what was in Ruby Central's best interest. Unfortunately for him he basically admitted to a crime because it came after he was terminated. He tried appealing to community and whatnot but anyone who's ever worked for a corporation knows that once you're terminated, it doesn't matter if HR forgot to take away your credentials or not, you simply don't attempt to access anything ever again. Having keys to something doesn't make you the owner.
majkinetor 1y ago
How do you monetize the server logs ?
- ameliaquining 1y ago
  Unclear, but I think it might have been something like, find out (via reverse IP lookups) which big companies depend on which gems, and then use that information to market consulting services to those companies.
  - majkinetor 1y ago
    I guess something sinister is also an option...
    - fifticon 1y ago
      well,yes, already that description is sinister; I might be getting too old.
      - majkinetor 1y ago
        That description is not sinister. Its just marketing. An example of sinister would be to sell those logs to someone who could instigate a supply chain attack targeting some of those companies.
- jzb 1y ago
  Try to identify companies making heavy use of $thing and use that as leads.
deleted 1y ago
[deleted]
bgwalter 1y ago
That "Executive Director" (whose salary is probably safe throughout all controversies!) does not sound very credible compared to: https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci... I'm only going by the corporate narrative structure of the director's post, who clearly wants to throw someone under the bus and cover up organizational incompetence. "Open" source has become so despicable.
- ameliaquining 1y ago
  Are you alleging that the screenshotted email isn't authentic? I'm only making a claim about that, not anything else.
  - bgwalter 1y ago
    I can't comment on any authenticity. Others here apparently dispute Andre's version, who clearly says he was on call: "As this situation occurred, I was the primary on-call. My contractual, paid responsibility to Ruby Central was to defend the RubyGems.org service against potential threats."
    - ameliaquining 1y ago
      I'm referring to the email containing the monetization offer, not the later controversy regarding disputedly-authorized access to the AWS account.
      - jcmfernandes 1y ago
        He ran the idea by a group of people, nothing more. We can disagree with it — so did RC — but that was it: bouncing an idea.

brigandish 1y ago

That puts the gem.coop repo in a new light.

cyrnel 1y ago

The response to that: https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci...

ameliaquining 1y ago
This is about a different part of the controversy, and doesn't respond to the allegation of a monetization proposal.
- tehryanx 1y ago
  Yes it does. He's refuting that in this part of the post: > When they finally did reply, they seem to have developed some sort of theory that I was interested in “access to PII”, which is entirely false. I have no interest in any PII, commercially or otherwise. As my private email published by Ruby Central demonstrates, my entire proposal was based solely on company-level information, with no information about individuals included in any way. Here’s their response, over three days later.
  - bsammon 1y ago
    A very specific denial. "I didn't propose this specific type of monetization". Would be better if he followed up with "Yes, I proposed monetization, but what I had in mind was this more specific, benign form of monetization:"

saghm 1y ago

Your addition also misses an important part where the only reason he was able to do that was because the servers were forcibly taken from the previous owners for the ostensible purpose of security, but the new regime forgot to change the passwords as part of that. At this point, it's probable that any attempt to just list the pertinent events isn't going to end up being as neutral as one might hope because even the choice of what context to include or exclude is itself editorial. This is the same lesson people might learn in a high school history class, just applied to something much more recent.

ameliaquining 1y ago
That's not accurate; the monetization proposal happened before the revocation of permissions. The controversy about various accesses that may or may not have been unauthorized (depending on whose story you believe) came later. Perfect neutrality is unachievable but that doesn't mean that every possible way of presenting the facts is equally valid, or even that it's impossible to distinguish presentations that are or aren't missing important context (see, e.g., the surprising success of Twitter's Community Notes).
tptacek 1y ago
Wait, you think the former maintainer breaking into Ruby Central's AWS account and changing its root password makes the former maintainers look better?
- typpilol 1y ago
  that's the one thing I've heard them not address yet is the changing of the passwords.
  - dismalaf 1y ago
    Arko kind of did address it in his most recent blog post. He claims he was doing what was in Ruby Central's best interest. Unfortunately for him he basically admitted to a crime because it came after he was terminated. He tried appealing to community and whatnot but anyone who's ever worked for a corporation knows that once you're terminated, it doesn't matter if HR forgot to take away your credentials or not, you simply don't attempt to access anything ever again. Having keys to something doesn't make you the owner.

majkinetor 1y ago

How do you monetize the server logs ?

ameliaquining 1y ago
Unclear, but I think it might have been something like, find out (via reverse IP lookups) which big companies depend on which gems, and then use that information to market consulting services to those companies.
- majkinetor 1y ago
  I guess something sinister is also an option...
  - fifticon 1y ago
    well,yes, already that description is sinister; I might be getting too old.
    - majkinetor 1y ago
      That description is not sinister. Its just marketing. An example of sinister would be to sell those logs to someone who could instigate a supply chain attack targeting some of those companies.
jzb 1y ago
Try to identify companies making heavy use of $thing and use that as leads.

deleted 1y ago

[deleted]

bgwalter 1y ago

That "Executive Director" (whose salary is probably safe throughout all controversies!) does not sound very credible compared to: https://andre.arko.net/2025/10/09/the-rubygems-security-incident/ https://andre.arko.net/2025/10/09/the-rubygems-security-inci... I'm only going by the corporate narrative structure of the director's post, who clearly wants to throw someone under the bus and cover up organizational incompetence. "Open" source has become so despicable.

ameliaquining 1y ago
Are you alleging that the screenshotted email isn't authentic? I'm only making a claim about that, not anything else.
- bgwalter 1y ago
  I can't comment on any authenticity. Others here apparently dispute Andre's version, who clearly says he was on call: "As this situation occurred, I was the primary on-call. My contractual, paid responsibility to Ruby Central was to defend the RubyGems.org service against potential threats."
  - ameliaquining 1y ago
    I'm referring to the email containing the monetization offer, not the later controversy regarding disputedly-authorized access to the AWS account.
    - jcmfernandes 1y ago
      He ran the idea by a group of people, nothing more. We can disagree with it — so did RC — but that was it: bouncing an idea.