5 ms·

The term you're looking for is a loaded question. https://en.wikipedia.org/wiki/Loaded_question https://en.wikipedia.org/wiki/Loaded_question Changing passwor

The term you're looking for is a loaded question. https://en.wikipedia.org/wiki/Loaded_question https://en.wikipedia.org/wiki/Loaded_question Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.

tptacek 1y ago
I love that you had to link to the Wikipedia question for "loaded question" for this. So you're saying, the answer is "yes": he logged into the root account, after he lost access to his own account, and changed the root password. OK then! Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they've decided must have happened. The person we're talking about here tried to (quietly!) monetize the server logs for RubyGems. Don't even try to play the "that's what RubyCentral says" card --- they published the email. The world doesn't always line up with the most sympathetic principles.
- typpilol 1y ago
  Everyone seems to gloss over it lol
- soraminazuki 1y ago
  The world doesn't line up with lies and spins of the most transparently corrupt actors either. Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash. When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.
  - tptacek 1y ago
    The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to quietly monetize the server logs from RubyGems. These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.
    - soraminazuki 1y ago
      I'll repeat: When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations. > insinuate: to impart or suggest in an artful or indirect way https://www.merriam-webster.com/dictionary/insinuated https://www.merriam-webster.com/dictionary/insinuated Note the word "indirect."
      - tptacek 1y ago
        Which of these insinuations have been "debunked"? Did they happen or not? If they happened, but you're OK with the reason they happened, they weren't "debunked"; they were, to you, "mitigated".
        jcmfernandes 1y ago
        Arko explained why he changed the password. Yes, he should have communicated the change, and that's on him. I still can't understand why RC preferred to publish a hit piece on him instead of... calling him to ask if he had changed the password? Bonkers. Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
- bgwalter 1y ago
  Always on the side of the bureaucracy and against the individual, no matter if it is IETF vs. Bernstein or Ruby Central vs. Arko? Personally I also think the monetization proposal was silly, but that was in August and Ruby Central rejected it. He logged into the root account because he thought he was on call and that someone was taking over Ruby Central, so he reacted in real time. With the obvious chaos and incompetence in Ruby Central and the ill defined takeover that does not seem far fetched. What exactly would he have gained by openly changing the root account for malicious reasons? He knows he would have been found out. It is not even a hack.
- busterarm 1y ago
  I'm shocked because you and I hardly ever agree on anything, but here we are in lock step. The HN commentariat is really shocking me here, because everyone in the professional space that I talk to about this thinks this is obvious and takes the same position. I won't follow the thought from there, but maybe you see where I'm going...

tptacek 1y ago

I love that you had to link to the Wikipedia question for "loaded question" for this. So you're saying, the answer is "yes": he logged into the root account, after he lost access to his own account, and changed the root password. OK then! Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they've decided must have happened. The person we're talking about here tried to (quietly!) monetize the server logs for RubyGems. Don't even try to play the "that's what RubyCentral says" card --- they published the email. The world doesn't always line up with the most sympathetic principles.

typpilol 1y ago
Everyone seems to gloss over it lol
soraminazuki 1y ago
The world doesn't line up with lies and spins of the most transparently corrupt actors either. Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash. When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.
- tptacek 1y ago
  The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to quietly monetize the server logs from RubyGems. These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.
  - soraminazuki 1y ago
    I'll repeat: When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations. > insinuate: to impart or suggest in an artful or indirect way https://www.merriam-webster.com/dictionary/insinuated https://www.merriam-webster.com/dictionary/insinuated Note the word "indirect."
    - tptacek 1y ago
      Which of these insinuations have been "debunked"? Did they happen or not? If they happened, but you're OK with the reason they happened, they weren't "debunked"; they were, to you, "mitigated".
      - jcmfernandes 1y ago
        Arko explained why he changed the password. Yes, he should have communicated the change, and that's on him. I still can't understand why RC preferred to publish a hit piece on him instead of... calling him to ask if he had changed the password? Bonkers. Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
bgwalter 1y ago
Always on the side of the bureaucracy and against the individual, no matter if it is IETF vs. Bernstein or Ruby Central vs. Arko? Personally I also think the monetization proposal was silly, but that was in August and Ruby Central rejected it. He logged into the root account because he thought he was on call and that someone was taking over Ruby Central, so he reacted in real time. With the obvious chaos and incompetence in Ruby Central and the ill defined takeover that does not seem far fetched. What exactly would he have gained by openly changing the root account for malicious reasons? He knows he would have been found out. It is not even a hack.
busterarm 1y ago
I'm shocked because you and I hardly ever agree on anything, but here we are in lock step. The HN commentariat is really shocking me here, because everyone in the professional space that I talk to about this thinks this is obvious and takes the same position. I won't follow the thought from there, but maybe you see where I'm going...