4 ms·

The world doesn't line up with lies and spins of the most transparently corrupt actors either. Shopify stole RubyGems from the maintainers, do you deny it? The

The world doesn't line up with lies and spins of the most transparently corrupt actors either. Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash. When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.

tptacek 1y ago
The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to quietly monetize the server logs from RubyGems. These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.
- soraminazuki 1y ago
  I'll repeat: When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations. > insinuate: to impart or suggest in an artful or indirect way https://www.merriam-webster.com/dictionary/insinuated https://www.merriam-webster.com/dictionary/insinuated Note the word "indirect."
  - tptacek 1y ago
    Which of these insinuations have been "debunked"? Did they happen or not? If they happened, but you're OK with the reason they happened, they weren't "debunked"; they were, to you, "mitigated".
    - jcmfernandes 1y ago
      Arko explained why he changed the password. Yes, he should have communicated the change, and that's on him. I still can't understand why RC preferred to publish a hit piece on him instead of... calling him to ask if he had changed the password? Bonkers. Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
      - tptacek 1y ago
        Here you are, saying out loud that RC would have needed to call Arko to ask if Arko had changed the password. There are one too many "if"'s in that sentence!
        jcmfernandes 1y ago
        I'm questioning why they didn't call him. Why? And why are you ignoring that RC did a hostile takeover of the repos? Again, RC stole the repos. What do you think of that?
        tptacek 1y ago
        Why in the everloving cosmic fuck did he not tell them? In a great many circumstances what he did is a crime. Nobody's coming after him on this but if this was me I would paper the everloving fuck out of what I did so there wasn't even a possibility that the owner of the account had any uncertainty as to what happened. I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have a professional interest in stories about people gaining unauthorized access to accounts. I assure you, the law doesn't weigh one party's transgression against the other the way you suggest it should.
- justinclift 1y ago
  > We also know that (4) he attempted to quietly monetize the server logs from RubyGems. What sort of monetisation? Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(
  - tptacek 1y ago
    What kind of monetization would have been OK?
    - justinclift 1y ago
      People are saying that this person just scanned the logs to gain an idea of the larger (commercial?) users, with the idea of approaching them for potential sponsorship. To me that seems like a good idea, not like a betrayal of trust as some people have been making out.

tptacek 1y ago

The premise of "have you stopped beating your wife" is that you made up the idea that I might have done it; simply asking the question is a form of slander. But that's not at all the case with Andre Arko and RubyGems. From everything we know: he really did (1) lose his personal access, (2) log in with a stale AWS root credential, and (3) change the password on the root account. We also know that (4) he attempted to quietly monetize the server logs from RubyGems. These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.

soraminazuki 1y ago
I'll repeat: When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror. What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations. > insinuate: to impart or suggest in an artful or indirect way https://www.merriam-webster.com/dictionary/insinuated https://www.merriam-webster.com/dictionary/insinuated Note the word "indirect."
- tptacek 1y ago
  Which of these insinuations have been "debunked"? Did they happen or not? If they happened, but you're OK with the reason they happened, they weren't "debunked"; they were, to you, "mitigated".
  - jcmfernandes 1y ago
    Arko explained why he changed the password. Yes, he should have communicated the change, and that's on him. I still can't understand why RC preferred to publish a hit piece on him instead of... calling him to ask if he had changed the password? Bonkers. Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
    - tptacek 1y ago
      Here you are, saying out loud that RC would have needed to call Arko to ask if Arko had changed the password. There are one too many "if"'s in that sentence!
      - jcmfernandes 1y ago
        I'm questioning why they didn't call him. Why? And why are you ignoring that RC did a hostile takeover of the repos? Again, RC stole the repos. What do you think of that?
        tptacek 1y ago
        Why in the everloving cosmic fuck did he not tell them? In a great many circumstances what he did is a crime. Nobody's coming after him on this but if this was me I would paper the everloving fuck out of what I did so there wasn't even a possibility that the owner of the account had any uncertainty as to what happened. I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have a professional interest in stories about people gaining unauthorized access to accounts. I assure you, the law doesn't weigh one party's transgression against the other the way you suggest it should.
justinclift 1y ago
> We also know that (4) he attempted to quietly monetize the server logs from RubyGems. What sort of monetisation? Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(
- tptacek 1y ago
  What kind of monetization would have been OK?
  - justinclift 1y ago
    People are saying that this person just scanned the logs to gain an idea of the larger (commercial?) users, with the idea of approaching them for potential sponsorship. To me that seems like a good idea, not like a betrayal of trust as some people have been making out.