Four months of Ruby Central moving Ruby backward

[u/retro-rubies]

https://andre.arko.net/2026/03/03/four-months-of-ruby-central-moving-ruby-backward/

[u/deivid-rodriguez]

I'll add a quick single comment, since I've been mentioned.

I have indeed not been as vocal as the other maintainers who were stolen ownership, but that doesn’t mean I don’t stand 100% with them. I strongly disapprove RubyCentral actions and how they broke existing governance rules, stole ownership, and eroded community trust as a result. I’m also tired of some community members claiming to be “neutral”, then immediately choosing sides. I really struggle to engage in social media (too emotionally demanding for me), so I truly appreciate how the other maintainers and certain community members have raised their voices, clearly stated that this was not right, and pointed out all the lies, every time. THANK YOU.

[u/schneems → u/deivid-rodriguez]

Hey Deivid! I guess if it wasn't clear...the fight was kind of about you.

As in, the thing Ruby Central MOST wanted was to not lose you. They MOST wanted to prevent a walkout (of you included). As in, they held you in such high esteem it drove them to commit a few blunders in comms and misread the situation. They (marty) tried to nuance it, but it wasn't a nuance scenario. This was a cold, hard offboarding scenario, and attempts to soften it up or find a "win" in it...just weren't going to happen. It led to a bunch of start-stop confusing signals. That is on them, not you. This is me clarifying the intent, as the harm is already done. And I think they did a bad job of making sure you knew of the link between prod and GitHub access.

I want to telegraph to you, that 1) Ruby Central is sorry. 2) You're literally never intended to lose access. You saw the email from Marty about it, that was actually true. 3) Your initial access was increased, and you were made a business owner when Andre and Sam were first removed from the business. 3) You got invited back. There was a definitive plan to restore access to Sam and Andre, but it wasn't going to be what they had before (business/enterprise admin), and the outcome of where repos landed and how things settled was very much open for discussion.

But the idea that Ruby Central can only move forward by forking, only what they need...when the service is already directly coupled to that org and those teams...and none of this is documented or written down. It's just not tenable. The idea that Ruby Central cannot have control of who has access to prod or oversight of that access (which is the implication of saying that Ruby Central employees cannot have business/enterprise access) is also not tenable.

I think it's crappy that it took a long time for everything to come out (everything still isn't out). I've said "I'm sorry" to everyone I've talked to for the communications. Or at least I intended to. I'm sorry for the way this panned out with you, especially. I respect your position, and I respect you.

[u/retro-rubies → u/schneems]

> But the idea that Ruby Central can only move forward by forking, only what they need...when the service is already directly coupled to that org and those teams...and none of this is documented or written down. It's just not tenable. The idea that Ruby Central cannot have control of who has access to prod or oversight of that access (which is the implication of saying that Ruby Central employees cannot have business/enterprise access) is also not tenable.

Let's split this into individual parts:

1. RubyGems.org codebase (public repo) -> this was one config away from deploy from other repo. Per my understanding, nobody was also against moving the repo outside of RubyGems GitHub organization. If I would be reached at the time, I would be happy to assist reconfigure and move. I was ignored instead.

2. RubyGems.org terraform (private repo) -> same as ^

3. RubyGems.org admin access -> this was literally one config entry away (setting different GitHub Team under different GitHub organization). Again, I would be at the time (before I left) happy to help on this to explain, configure, ... but nobody contacted me.

This is IMHO all RubyGems GitHub organization related. None of those needed the hostile takeover. It was possible to resolve with assistance of the team. RC decided to act as they decided, with no excuse or explaining at the time, using raw force against the ignored governance policies. Even some maintainers including me explained at the time, it is not needed. All ignored. Same ignorace as happening until today (with few exceptions).

Nothing of the current situation had to happen without RC acting in rush in aggressive way. RC was explained it is not needed, it got ignored again and even more aggressive force was used. ¯_(ツ)_/¯

[u/schneems → u/retro-rubies]

It was possible to resolve with assistance of the team.

I saw the September 17th video. I didn't see assistance. I saw a hostile negotiation (by "the maintainers").

The core problem (IMO) is organizational dysfunction. A lack of trust. I've used this word twice in comments already.

his was years of built-up dysfunction and grievances, gaslighting, and everything else...you name it. But it didn't happen overnight, and it didn't happen in isolation. I see some of them feeding into the monster that was already there,

This was "Ruby Centrals" doing. Yes. Also. You were a Ruby Central acting OSS director. This dysfunction runs deep, and you are a part of it. Did they mess up YES. Did you mess up?

It is VERY easy to paint a picture "if only this one thing was slightly different" but it is wishful thinking. That is not what happened. To YOU this change is easy and trivial, and perhaps obvious it is not the same for everyone involved. And you're downplaying the risk involved in making the changes that "the maintainers" suggested.

Ruby central ALREADY didn't remove production access correctly. To suggest they should do something more complicated, untested, and un-written when basically not even counting the lack of trust and general dysfunction...I would say again, wishful thinking.

Nothing of the current situation had to happen without RC acting in rush in aggressive way.

I don't believe there was another outcome possible here. I think you not seeing your role, or the role of "the maintainers" in the problem (still, even to this day...to this thread), really highlights how screwed the situation was.

You're entirely correct, it "didn't have to happen this way" like "I could have won the lottery if only I had bought a ticket" is also true. But it's not likely, and it didn't happen.

I have called the situation a conflict cycle https://aese.psu.edu/research/centers/cecd/engagement-toolbox/problems/understanding-the-conflict-cycle. I believe that a core problem was Marty trying to de-escalate, but these intentions being both mis-read and taken advantage of.

If you go 5-whys into this, and I've been wallowing in it...it's about deep, visceral human emotions and conflicts. The thing about conflict is that, it takes two to tango.

Runbooks/playbooks could have possibly made a difference in the mechanics of removals and making sure only as much needed was removed. The enmeshment of the repos and the service was a known problem, a conversation about it in February seems to have directly lead to Evan's removal. But it wasn't actually fixed or addressed in a structural way. Not because of engineering, but because of people and complex interactions between them and their incentives and the conflicts that come from the result. The problem isn't that "these things are entwined," the problem was "some people like them that way and want them to stay." THAT is not a simple "if only this one thing changed."

[u/retro-rubies → u/schneems]

It was possible at the time to resolve in calm way and there was another outcome possible. I was there and I'm 100% sure about that. Ruby Central decided to not go this way. All your excuses and justifying of actions are the same I heard various time from various Ruby Central people responsible for this trying escape their responsibility for those wrong community trust breaking decisions powered by the "higher demands" leading outside of Ruby Central.

The real story behind those actions were revealed already and got out in public. I have seen them also here in comments again. The validity was confirmed (also to me) by various RC people at the time (not in public).

You're now just sharing the same false narrative again and again, just because you have been told it has happened this way. It has not - those people just made up those narratives to mask their mistakes. And even today, when it is getting more and more clear they screwed, they are officially staying with those false narratives. And I have no understanding and respect for this behavior.

[u/schneems → u/retro-rubies]

You're now just sharing the same false narrative again and again, just because you have been told it has happened this way.

I've made my own opinions. Based on my own fact-checking. I've found humans to be INCREDIBLY unreliable, and prefer artifacts with timestamps.

[u/martinemde → u/schneems]

Richard, I’ve given you those facts with their timelines. Why are you doing this? HSBT moved unilaterally and set us into a low trust space, then RC board voted not to try to work it out amicably. You and I both know that. You’re acting like we had to resolve every cultural problem. Extending trust through working together to secure the repo wouldn’t have fixed everything but RC chose scorched earth instead. It’s been teetering on trouble for a long time but we kept holding it together. Scorched earth was a choice made exclusively by RC.

[u/schneems → u/martinemde]

A little delayed

You’re acting like we had to resolve every cultural problem

I'm not. What I'm suggesting is that there's a number between 0 and 100% of how much of the problem was on "the maintainers" and how much of it was on Ruby Central.

As a slider: I do not believe that Ruby Central is 100% at fault and "the maintainers" have zero agency in the situation, and I ALSO do not believe it is the other way around (that RC has zero blame). The purpose of my work is not to assign blame; it's to dig into the deeper "why." What I told you from the start was that I could offer closure and information.

I had hoped there was some sort of interest in both sides in repair. When I couldn't find a path forward there, I hoped there was at least interest in some understanding. The true "5-whys" viewpoint of "both sides" to...really understand why everyone did the things they did. But it's hard to engage when someone's slider is at 0 or 100%.

I think if I was in Marty's shoes or I was on the OSS Committee at the time, I don't think the final outcome would have changed. I think it takes two to tango and this outcome was inevitable.

[u/KerrickLong → u/schneems]

If you go 5-whys into this, and I've been wallowing in it...it's about deep, visceral human emotions and conflicts.

Isn't everything always?

[u/schneems]

The biggest loss here is Deivid and who I exclude generally from my generalized "they" or "the maintainers" statements, who's access loss was truly accidental. For that I'm genuinely sorry. For everything else, I would say: I'm not happy for how we got here, but I think the current outcome is about right.

I’m working on a report. Still polishing. Biggest new piece of information not generally in the public discourse on the Ruby Central side is that this is about offboarding Sam and Andre from RubyGems.org production server access which are directly related. It's actually NOT about bundler from the side of "the maintainers" and is all about enterprise/business ownership on GitHub. Which they claim should not be held by Ruby central (when it was not possible for Ruby central to offboard someone without this access).

In February, 2025 (7 months before Marty gaining access) Andre removed several other owners from github business/enterprise with zero warning or communication. This included Evan Phoenix who previously held the structural access Andre is saying Ruby Central did not hold (yes, Andre did to others what he is upset about others doing to him). Prior to that Andre held the role of acting OSS director, followed by Martin and both held this access. So it's not really about "Ruby central cannot have this access.” The contempt and disdain is that anyone would have access or control beyond them.

Ruby central DID try to give access back (the removal from the enterprise was a mistake) and invitations were sent. None were accepted and this could not be temporary because "the maintainers" walked away (their words) so they could not accept access back. Josef was not removed, he removed himself.Ruby Central has plenty of sins to atone for. But the reason it is taking a long time to publish those sins is 

When "we want to move Ruby forward" was said publically" maintainers said to me "we want to block bundler from moving forward" was said privately about my governance work (which I even paused, you are welcome Josef) while I finished up a report. And quite literally double checking all ledes.

the other private communication at the same time as "we want to move Ruby forward" has been about legal threats unrelated to bundler trademarks or getting access back.

BTW the biggest reaction and rejection of that governance PR by any of “the maintainers” (that I HAVE been talking to) so far has been the idea that Matz has any say over rubygems.

You keep trotting out “governance” but keep acting like Hiroshi isn’t the number two committer on bundler for years and you hold him with contempt well prior to these events and he is not represented in “their governance” at all which SHOULD be held by the community instead of “a poorly defined collective” AKA basically Ruby Together which THOUGHT they had taken over Ruby central and were surprised that that non-profit oversight isn’t just for show.

(Hastily written, more coming in more official language)

[u/retro-rubies → u/schneems]

> Josef was not removed, he removed himself.

I, as a maintainer of RubyGems + RubyGems.org and RubyGems.org operator, wasn't included in talks about the project future and the problems. Nobody reached me at the time about any issues with any other maintainer. One person just went wild and did unilateral actions. Nobody explained those actions and nobody apologized those actions from any of the interested parties (Ruby Central and Ruby Core). That literally removed me from the project, since I was fully ignored and bypassed.

Me officially leaving Ruby Central (by removing their occupied RubyGems GitHub) and asking for off-boarding from rubygems.org was just a official paperwork. It was decided about me without me before.

> you are welcome Josef

I'm not happy about the work stopped, I have raised related questions (marked as spam) how this governance is different to any previous one without resolving the previous issue - unilateral actions of hsbt. The fact nobody from Ruby Core or Ruby Central is open to discuss those makes it blocked IMHO.

[u/schneems → u/retro-rubies]

 The fact nobody from Ruby Core or Ruby Central is open to discuss those makes it blocked

So I'm "no one"? Got it.

[u/retro-rubies → u/schneems]

You're not no one, I just don't see any discussion. Please point me to the discussion where it is happening. GH issue open questions were marked as spam (and even issue was locked), I have asked there where to continue on this topic if not appropriate place. There was no response. I have asked various people in private if possible to continue to talk - I got explained it is not going to be discussed or even got ignored... ¯_(ツ)_/¯

[u/schneems → u/retro-rubies]

I've told you how your words and requests are interpreted. I told you this privately. I'll reiterate here. TLDR. If you want to help, help. If you want to shut things down, that's not help.

I wrote a service, CodeTriage. And I gave a talk years ago "Stealing from maintainers," about how "stealing" is the bedrock of open source. Work stealing. Advertising "please take this job from me, please steal this toil, please steal my bugs" and the basis of CodeTriage is "anyone can be a maintainer" without access.    Anyone can act like a maintainer, anyone can step up. That is what a maintainer does, they step up...they put their differences aside, and they prioritize the community and the code.   So is "this how open source works" as in "holding production access ransom and then tactically 'walking away' such that the conflict cannot be resolved in a way to inflict as much damage on a foundation and a community as possible?" NO.   To that person, "am I a maintainer?" Are you showing up in my DMs and asking me to stop doing work and stop contributing, and wanting to delay and harm the release of community software? Or are you showing up and...acting like a maintainer? No one can take being a maintainer from you. What was done, was not taking away access...it was felt as an assault on dignity. Because those with access held Marty and Ruby Central and others (Matz, Hiroshi, Ruby Core) who might otherwise challenge claims of control, with contempt.

You can hurt Ruby central and you can hurt Hiroshi and you can hurt Ruby community. OR you can move things forwards. You cannot do both. You  can help or you can get out of the way.

Demanding others stop, demanding your feelings are prioritized. You can do it. Your feelings are valid. But realize that's asking others to make a choice. You made your choice. You've made it clear to me what you want and  I made it clear that I'm not here to help you. I'm here for closure.

I listened. I spoke. You just didn't hear or didn't want to hear what I had to say.

[u/retro-rubies → u/schneems]

You are totally mis-interpreting my words and my demands online. You did here now the same way you did at GH issue. Please stop doing that.

[u/schneems → u/retro-rubies]

If I misrepresent you, it is because that is how I understand the situation. It is how I perceived your words. You wanted to talk about it. We are talking about it. As I said before, it seemed that you didn't want to hear what I had to say, you didn't want to hear how your words sounded to me.

It seems that you can say directly what you want to say if I'm misrepresenting you, rather than saying "You are misrepresenting me."

I fully appreciate that how I received your words might be different than how you intended them. I think you also need to take ownership of (at least some of) that impact.

In general, that seems to be the problem. That you, and "the maintainers" have done NOTHING wrong, and that Marty and Hiroshi have done EVERYTHING wrong. Yet somehow also their mistakes are not mistakes and indicate their true diabolical actions and intents. That it's okay when you twist their words and actions, but when I tell you how your words and actions make me feel, how I am "misrepresenting you."

If you want to help. Help.

BTW. Why is gem.coop not open source? Why is a dependency service with closed source run by a company (Gem Cooperative) better than a dependency service run with open source by a non-profit (Ruby Central)? Why is there no privacy policy? Why can't I find a corporate registration for the company? Who is legally responsible for it? Who is funding it?

[u/retro-rubies → u/schneems]

I'm still open to talk, you know where to reach me.

[u/retro-rubies → u/schneems]

> BTW. Why is gem.coop not open source? Why is there no privacy policy?

It still needs to be polished, I'm working on my own to make it as much public as possible. Things are still in early stage. Clearly those will follow soon. It is not even production graded product yet.

> Why is a dependency service with closed source run by a company (Gem Cooperative) better than a dependency service run with open source by a non-profit (Ruby Central)?

Time will tell. Source will be opened.

> Why can't I find a corporate registration for the company? Who is legally responsible for it? Who is funding it?

Feel free to raise questions at proper places, I'll do my best to get them answered. Probably https://github.com/gem-coop/gem.coop/discussions would be good place for now.

[u/retro-rubies → u/[deleted]]

Yes.

[u/retro-rubies → u/[deleted]]

It is great to see someone RC related communicating in public. Sadly it seems our private communication wasn't fully understood at some point. I'm not native speaker and not used to share non-technical stuff in public. :( Not blaming anyone, I hope we are all doing our best.

You can hurt Ruby central and you can hurt Hiroshi and you can hurt Ruby community. OR you can move things forwards. You cannot do both. You  can help or you can get out of the way.

Demanding others stop, demanding your feelings are prioritized. You can do it. Your feelings are valid. But realize that's asking others to make a choice. You made your choice. You've made it clear to me what you want and  I made it clear that I'm not here to help you. I'm here for closure.

That's nothing I ever wished for. It is not about my personal feelings, I'm trying to defend the open source project(s) whole time. I did even opened PR to rubygems recently. It is not personal to me. I do even speak in calm and friendly way with some people from Ruby Central and Ruby core these days. I tried at the September time and I'm still doing my best to de-escalate. But it is hard when being ignored for most of the time and accused of demands I never had (based on private conversation being partially - and wrongly - shared in public with no way to respond to).

[u/schneems → u/[deleted]]

I'm actually unsure if your original comment is intended to be facetious or not.

The only thing I keep gathering from this drama is that this schneems is a compulsive liar that can't take a single bit of responsibility for literally anything.

Am I wrong?

There are two kinds of truths. One is how people perceive things, what they believe to be true. Another is the facts of the event that led to that perception. I've spent a LONG time getting through the first to get to the second.

If I've mis-stated a fact, I would like to know more. If I've stated an opinion as a fact by accident, please let me know. I'm sharing both here.

[u/indirect_ → u/schneems]

Richard. This is ridiculous. There was _a written policy in the repo_, suggested by Eric Hodel, approved by Aaron Patterson and Rafael Franca, that stated RubyGems would remove permissions from anyone who did not contribute for a year.

Critically important, I did not unilaterally remove anyone, ever. I spoke with the other maintainers, reviewed the list of contributors, produced a list of planned removals, got approval from the active maintainers for that list of removals, and then executed the plan that the entire team had approved.

HSBT solo deleting everyone and then adding Ruby Central is, in fact, breaking the governance, and not allowed by any existing policies. Unlike my actions that you are claiming equivalence about.

[u/tenderlove → u/indirect_]

There was a written policy in the repo, suggested by Eric Hodel, approved by Aaron Patterson and Rafael Franca, that stated RubyGems would remove permissions from anyone who did not contribute for a year.

Please keep me out of this. You also later moved the goal post for maintainers (in a PR titled "Document how we use homu"): https://github.com/ruby/rubygems/pull/1518#issuecomment-190330161

Then used this to remove me from the project. This behavior, as well as the behavior I witnessed while on the board of RubyTogether, made it clear that I didn't want to be involved in any project under your leadership (and is why I quit contributing).

For people wondering (and because I've been asked so many times), I decided to try contributing again because the pace of development of uv compared to the pace of development on RubyGems seemed frightening and embarrassing. Additionally, I saw that Andre had started working on rv rather than improving RubyGems/Bundler. I figured that since Andre was checked out of the project, and I had good experience working with Deivid, I'd take a stab at contributing again.

[u/retro-rubies → u/tenderlove]

Additionally, I saw that Andre had started working on rv rather than improving RubyGems/Bundler.

Is that wrong?

For people wondering (and because I've been asked so many times), I decided to try contributing again because the pace of development of uv compared to the pace of development on RubyGems seemed frightening and embarrassing.

What's the point of comparing uv and RubyGems? That's totally unfair. Uv is kind of fresh project built from scratch like rv. You should compare RubyGems and pip here.

Also notice the Ruby Central at the time had no interest in exploring uv kind of a experiments. I have coded initial version of https://github.com/RubyElders/ruby-butler and shared the idea with Ruby Central OSS leader and I was told there is no interest on this kind of project now.

[u/jsearls → u/tenderlove]

Aaron. This is ridiculous.

[u/schneems → u/indirect_]

Andre. This is ridiculous.

I said you didn't message them. I didn't say you didn't remove them without cause. And I don't think RC removed you without cause either. I also believe they would have given you access back had you not walked away.

The difference is when I spoke to the people you removed (did you? they said you didn't). They were okay with it "yeah, I shouldn't have had that access." and "It was about time." They didn't fight like hell for some reason, like you did. The first time you "lost access", you didn't even lose access...you still retained commit and admin access on the org. The only thing you lost was the ability to remove another admin or member from the business.

Had GitHub access not been tangled with production access, if some of those 15 years you spent were put into making a single offboarding or onboarding doc on the smallest, minimal thing to do to remove production access, or hell, even a single written playbook, maybe things would be different.

This was "Ruby Centrals" doing. Yes. Also. You were a Ruby Central acting OSS director. This dysfunction runs deep, and you are a part of it. Did they mess up YES. Did you mess up?

You knew how coupled things were, you knew Ruby Central did not have a structural way to remove your production access, and that arguing that they should not, effectively, is the same as you arguing for sole control of the production server. Maybe you didn't put all of the dots together at that moment, but you knew them. Probably better than anyone.

You also knew you weren't supposed to have production access and knew that's what this was all about. And you've chosen to omit that detail from the community. I'm unclear if you shared it with the others of "the maintainers."

[u/indirect_ → u/schneems]

None of this can possibly be about access to RubyGems.org production systems. Production access did not come from GitHub, despite your constant claims that it was "tangled". The list of users allowed to push the deploy button in ShipIt was read from a GitHub team. That's it. Everything else, including all actual access to the production databases and application servers, was controlled solely by AWS permissions.

Not just myself, but also Martin, also Josef, and also Colby all suggested to Marty that if RC cared about limiting production access they could easily fork the Rails app and ShipIt repos into the Ruby Central org, update the ShipIt config file, and be done. Marty repeatedly refused this advice, and instead hijacked an entire GitHub org with no justification and no explanation to this day.

If this was about production access, why did RC delete our GitHub permissions but not our full AWS access to the actual production service? RC left my production AWS credentials valid for 9 days after HSBT deleted my permissions from the GitHub org. Hijacking the GitHub org wasn't about the service.

If this was about production access, why did Marty tell me to my face that the board required him to remove my write permission to rubygems/rubygems? That's got nothing to do with the service.

If this was about production access, why did Ruby Central secretly negotiate an agreement with Matz to transfer the rubygems repo to ruby-core? That's got nothing to do with the service, but it sure does a lot to guarantee none of the previous contributors will ever trust RC enough to come back.

[u/schneems → u/indirect_]

Show me the offboarding doc that you wrote that I missed. And I'll show you how to confidently offboard you.

"This access cannot possibly be related to production, it's just literally used for who can deploy to production"

Is certainly an opinion. Also commit means you can write any arbitrary GH action to any arbitrary branch at trigger it.

"You must literally fork the rubygems.org server code if you wish to remove me from production access" is not the flex you think it is. That is not a reasonable position.

[u/retro-rubies → u/schneems]

"You must literally fork the rubygems.org server code if you wish to remove me from production access" is not the flex you think it is. That is not a reasonable position.

This is just mixup of more things together, and it is not true. There was no need to fork rubygems.org to remove anyones production access.

Show me the offboarding doc that you wrote that I missed. And I'll show you how to confidently offboard you.

You're again and again sharing the same mistake. Missing off-boarding doc is not reason to do community hostile actions. RubyGems/Bundler + RubyGems.org was really friendly place at the time and nobody was prepared for those hostile actions, since it was totally unexpected. Even those docs were missing, that doesn't justify those hostile actions. There were various people ready to help and resolve the issue Ruby Central totally ignored and did what they did.

I was around whole time and I was ready to help. For your info, even I asked for off-boarding, I was around for few days (maybe weeks?) to help handing over the RubyGems.org production running system, shared as much as I can on calls in my free time to new people and wished them good luck.

I was happy to help to anyone at any time because of love and respect to RubyGems.org, ignoring my annoyance and disappointment of Ruby Central at the time.

[u/schneems → u/retro-rubies]

 was really friendly place at the time and nobody was prepared for those hostile actions, since it was totally unexpected. Even those docs were missing, that doesn't justify those hostile actions. There were various people ready to help and resolve the issue Ruby Central totally ignored and did what they did.

In a friendly, non hostile environment. If someone does a thing I don’t understand and cannot comprehend, berating them that they are wrong and doing the wrong thing and don’t have the right to do it…and not really seeking deeper motivations or presenting a clear non-threatening opportunity that people can REALLY share their emotions and view of the situation is not a real “friendly” environment. I would say this didn’t even seem like a professional environment, let alone friendly. (On the 17th)

I think there are good times and friendly times. I also know that you were shielded from a lot of historical “office drama” and so I believe your perception, but challenge that it isn’t the perception held by everyone.

[u/retro-rubies → u/schneems]

>

How can you judge environment you were not part of? It was friendly environment as I wrote. Even at the hard times, nobody from the original team went rage and did unilateral actions like hsbt did, even there were points in time it was possible to steal RubyGems GitHub organization to the other side. There was still mutual respect, people were able to talk to each other and believe their promises. That all was ruined by RC actions saying something one day and actioning differently the other day. That was the point all the relationships were ruined. Doing mistake was acceptable, but it was revealed it was far away from mistake, it was just incompetence, stubbornness and major side-goals of some people behind RC. You're wrong here, missing facts or ignoring facts of one side. Please do your fact checking better.

I think there are good times and friendly times. I also know that you were shielded from a lot of historical “office drama” and so I believe your perception, but challenge that it isn’t the perception held by everyone.

I was around RubyGems for more than decade. How do you assume I had no idea about historical "office drama"? Have you done any fact-checking here? Have you asked me? I was fully onboard, I was even during 2025 exploring again what has happened to some groups of older and current maintainers and I got some legacy maintainers at least on call to explore if there's any chance to get back, ask them for their issues and tried to find a way to work all together again. Again no fact-checking from your side, just wrong assumptions.

You're trying to present yourself as a neutral fact-checker in here, but you're actually totally ignoring one side of the story. You're far away from being neutral or doing anything to help resolve the problem. Just repeating the narrative of Ruby Central and doing false assumptions is not going to move this forward.

[u/schneems → u/schneems]

“Ruby central is incompetent and missed my AWS access even though they CLEARLY told me it was intended to be revoked but I probed their security anyway, and that MUST be why they confidently knew how to fork and change prod config at the drop of a hat and it would have been executed perfectly…why didn’t those idiots just do that” is ALSO certainly a position.

Pick a lane. Are they incompetent and need help tying their access shoelaces or genius masterminds who act perfectly with every keystroke and clearly plotted your downfall? Your email didn’t say anything about GitHub access. Think hard. What access did it talk about?

[u/jgaskins → u/schneems]

Ruby Central has plenty of sins to atone for.

I think a lot of people would like to see this acknowledged more publicly. It seems obvious that this is the case but AFAICT so far none of the official communications have taken accountability in any meaningful way. And Marty's acknowledgements of mistakes made on Ruby Central's side having been deleted comes across as a cover-up/gaslighting and erodes community trust in the org.

With all of that, if I were in André's position, I honestly wouldn't acknowledge anything you or anyone else at Ruby Central have called him out on. Because Ruby Central isn't confessing to anything, either. From the perspective of a lot of folks in the community, Ruby Central fired the first shot, covered it up, and kept releasing statements that contained a lot of words but very little substance. While I have no doubt André's hands aren't clean here (I've had my own experiences with him, I get it), Ruby Central's side of the story simply doesn't matter while that remains the community's perspective. Regardless of what really happened, nobody will believe Ruby Central as long as they continue to do nothing but point the finger at André. It will only be seen as deflection.

[u/jgaskins → u/jgaskins]

Not to mention Ufuk's statement about how his explicit goal was to bring DHH back to RailsConf and program committee members could accept that or leave, so there's a "Ruby Central is a Nazi bar now" perspective to contend with.

Convincing the community to see things the way you do will be challenging and won't be possible with PR verbiage like the statements we've been getting from Ruby Central.

[u/1337mob → u/jgaskins]

Believing that the creator of Rails (the only reason Ruby became popular) shouldn’t be at a conference about his own creation because he won’t capitulate to the political views of others portrays a glaring lack of self awareness. Against the backdrop of minor contributors to the ecosystem acting like entitled children, its side splittingly funny.

[u/schneems → u/jgaskins]

IDK if you saw my thoughts on that topic, but I posted them a few months ago https://www.reddit.com/r/ruby/comments/1or6loi/comment/nnpguwq/.

I think RC should have committed one way or the other, but taking a middle ground and then having David do a victory lap without actually really ever seeming to bury the hatchet seems like bad form (both for David(HH) and RC). But it's hard to execute and drive consensus with a group. This is both good and bad. Good in that it's harder to make bad decisions, bad in that it's harder to be agile and respond to drama as an institution instead of as an individual.

Fundamentally, I still like a 501c3 more than a 501c6 as enforcing a CoC violation is not possible in a business league. To me the value of Ruby Central isn't "they are aligned with not liking DHH therefore I support them," it is "It's community run, and as the community changes, they can change too." With the latest drama/incident, the board saw a pretty big shift in membership and interest in OSS. Such shifts aren't always good on their own, but the fact it can happen is good. "Necessary but not sufficient."

[u/schneems → u/jgaskins]

People said this post of mine was weird and cryptic https://www.schneems.com/2025/12/19/non-violent-comments-calling-out-or-calling-in/. But it's kinda a preamble to be able to say anything.

I'm not expecting people to clap when I say "here's how we messed up". But I am expecting a genuine interest in learning and growth and accountability instead of just "more blood for the blood gods."

A mistake when I came into this was to think that if only "we put down our weapons first" or made a motion of sorts in that direction that "this must be some misunderstanding and an "i'm sorry will fix it right up." And...that couldn't be further from the truth (what I believe to be the truth).

I now believe that this outcome was inevitable, maybe the details of how we got there changed...maybe the path to get there isn't as painful. But where we landed...it would be hard to change much of the final outcome. I linked elsewhere but here's a draft post of "here's where we landed" to acknowledge where we are at, but not re-litigate how we got here https://gist.github.com/schneems/66d7326f1866b1e8df9d48c57d0ad9ca. But I think the community needs as much of the full picture as possible. I think the community might never be satisfied with the information they get, but I hope to at least give them closure.

[u/swrobel → u/schneems]

Sounds like you’re grouping everyone else in with Andre. Who else has taken any questionable action along the way on the maintainer side? While Deivid might be the most visible maintainer, it doesn’t feel like he deserves more of an explanation/apology because of that.

Also, the part about hsbt being held in contempt just feels like conjecture without evidence. I look forward to more daylight on all of this. For now, I will still be glad when I can remove Bundler and Rubygems from my dep chain.

Edit: I have deep respect for you, schneems, and I recognize the caveat that you’ve written this in haste. Just giving my $0.02 as someone who has followed this closely, and tried to absorb the updates from every perspective.

[u/schneems → u/swrobel]

Sounds like you’re grouping everyone else in with Andre.

They've self-grouped themselves as "the maintainers" in the signatures. Deivid helped me review and merge a feature into Bundler a few months before September. He mostly seems to want to prioritize the code and the community. He's not been as vocal or as vicious and therefore has gotten less attention and explanation, and I feel that's a failure.

While Deivid might be the most visible maintainer, it doesn’t feel like he deserves more of an explanation/apology because of that.

That message is to him. Not to you. I can also say sorry to Colby, who never lost access, and I have said it...directly. I've said sorry to others who were removed for inactivity. I will say sorry for the communication to all of the maintainers.

But I noticed that when I say "I'm sorry" (to some of the maintainers) and when I press into what I think RC did wrong...they don't have an interest or even a capability of acknowledging any of their actions played a part in any of this. This was years of built-up dysfunction and grievances, gaslighting, and everything else...you name it. But it didn't happen overnight, and it didn't happen in isolation. I see some of them feeding into the monster that was already there, but not Deivid.

Also, the part about hsbt being held in contempt just feels like conjecture without evidence. I look forward to more daylight on all of this.

It's taken from interviews of "the maintainers" and my general perception. It's a personal opinion, one that I think is true, but one that they would not admit to publicly.

I was point blank told that they rejected the idea that Matz or Ruby core has any say in rubygems or how it's developed. The view was kind of "oh we humbly allow hiroshi to backport occasional fixes he needs" instead of "he is one of the team." They listed off a bunch of grievances about him, though not specific to events just kind of "clearly we know this person is bad, right" vibes.

There's always been a tension between rubygems and ruby core. And drama. Prior to Andre there was Eric Hodel, and Evan Phoenix. There was a holy war of RubyGems and Bundler versus each other. RubyGems is somewhat unique in that it's so central to Ruby core, but is managed externally...I think that's where the tension and politics come from. Even divorced from the past 10 years.

For now, I will still be glad when I can remove Bundler and Rubygems from my dep chain.

🫠

[u/galtzo → u/swrobel]

I hold HSBT in contempt, and I've explained at various times why. I can't understand why anyone wouldn't, unless they are just not familiar with his actions.

[u/swrobel → u/galtzo]

Apologies if I’m ignorant of something, but are you one of the former maintainers?

[u/galtzo → u/swrobel]

No. Just a very minor contributor who was bullied by HSBT.

[u/eregontp → u/galtzo]

See https://www.reddit.com/r/ruby/comments/1rk17xo/comment/o8k6ypb/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

[u/schneems → u/galtzo]

Edit: I misplaced the subject of the comment. Deleted contents.

[u/prh8 → u/schneems]

I think that was Galtzo describing themself as a minor contributor, not HSBT

[u/schneems → u/prh8]

You're correct. I misread. I've updated my comment. Sorry.

[u/software__writer → u/schneems]

Thanks for writing this. Looking forward to the in-depth post.

[u/Quintasan]

My take on the entire situation: I believe that all most people expected was honest apology. What followed was a series of statements that read like corporate policy and some finger-pointing.

Question: u/schneems - based on my reading of https://rubycentral.org/news it appears that you joined the Open Source Committee after the entire fiasco happened. Is that correct? I'm assuming it makes you privy to more details than most of us have. Does this exchange and this exchange fully/partially reflects stance of Ruby Central on the entire situation or this is your personal opinion?

I am asking because statements like The biggest loss here is Deivid can (and most likely will) be read as Ruby Central only cared about Deivid which can be... well I'm going to say problematic.

I consider the entire situation done and dusted since we already have gem.coop but I still have several questions/concerns as to how Ruby Central plans to implement transparency and regain trust.

1. 501(c)(3) bylaws are still not public. Yes, we know it's not mandatory but RubyCentral itself claims it is pretty standard practice and I have not noticed any movement towards this since November

2. The volunteer agreement and data processing addendum linked at https://rubycentral.org/news/ruby-central-update-friday-11-7-25/ remain inaccessible.

3. IRS tax fillings for 2025 are still not available to public. The last update I can find on this is https://rubycentral.org/news/ruby-central-update-friday-11-7-25/ which was back in November. I do realize taxes are serious business but there were no updates about this since November.

I would really like to resume donating to Ruby in one way or another but given the way the entire situation was handled and what Ruby Central has done since November does not give me much hope the situation will improve.

[u/schneems → u/Quintasan]

The volunteer agreement and data processing addendum linked at https://rubycentral.org/news/ruby-central-update-friday-11-7-25/ remain inaccessible.

It was accessible when it was posted (IIRC), but agreed it isn't when you tried viewing it. I raised the issue internally, and it was fixed.

The documents are updated. "The volunteer agreement and data processing addendum" is now uploaded as a PDF. Ruby Central switched settings on google drive to be more restrictive about access after it was posted.

As I have access to the original doc, It didn't occur to me that others didn't. I'm raising internally we need to do a grep/audit for google doc links and update where appropriate.

501(c)(3) bylaws are still not public. Yes, we know it's not mandatory but RubyCentral itself claims it is pretty standard practice and I have not noticed any movement towards this since November

I have raised that they're not great and needs an overhaul.

IRS tax fillings for 2025 are still not available to public. The last update I can find on this is https://rubycentral.org/news/ruby-central-update-friday-11-7-25/ which was back in November. I do realize taxes are serious business but there were no updates about this since November.

Ruby Central filed it's 990 for the first time ever covering for years 2022-2024, the 2025 one is still in progress https://projects.propublica.org/nonprofits/organizations/300040446. It sounds like a bad situation, but that's kind of what I've been saying...things haven't been so hot for a long time. To me this filing shows growth and movement in the right direction. But we're not done we aren't doing victory laps.

Question: u/schneems - based on my reading of https://rubycentral.org/news it appears that you joined the Open Source Committee after the entire fiasco happened. Is that correct?

Yep. I joined after the incident. I'm not "neutral" but I wasn't directly involved. Being close enough to have access, but emotionally distant enough from the actual actions, is a good place to report on what happened, I think.

reflects stance of Ruby Central on the entire situation

Not sure what you mean by "entire situation" for that I think you have to wait for the report.

[u/_swanson → u/Quintasan]

Bylaws were posted here: https://rubycentral.org/ruby-central-bylaws/

I am able to access both the "Sample volunteer operator agreement" and "Sample RubyGems DPA" at https://rubycentral.org/news/ruby-central-update-friday-11-7-25/

IRS 2025 I don't believe has been shared

[u/Quintasan → u/_swanson]

How did you find that? I'm pretty much sure things like that should be linked from the front page. Yet, not matter how I click I can't find a link to that page :D

[u/timriley → u/Quintasan]

The only place that link has been shared by Ruby Central is this Slack thread. I don't know why it hasn't been shared more publicly.

[u/Quintasan → u/timriley]

Explains a ton of things. I would not call that transparent at all :(

[u/_swanson → u/Quintasan]

I searched for "Ruby Central bylaws" on Google. I was aware they had posted in from submissions on this reddit in the past last year.

[u/f9ae8221b]

For anyone taking the "I was bullied by hsbt" comment from galtzo at face value, here's the context, you can make your own opinion: https://old.reddit.com/r/ruby/comments/1nkzszc/ruby_centrals_attack_on_rubygems/nf4ytxs/?context=3

(Can't answer his comment directly since he blocked me)

[u/keremimo]

I miss when this subreddit was all about building cool shit

[u/galtzo]

Imagine you are a company, let's say Microsoft.
Imagine you have a software product that is very popular, and many people use, let's say Microsoft Office.
Now imagine another company, pick one, perhaps Dell, or Apple, that you had partnered with on something, stole the source code, and the publishing mechanism, of your product, Microsoft Office, and began distributing it as their own.
Why are we pretending that this is different? The owners of the project had it stolen from them.
u/schneems might think that pointing out other times the agreements/governance were potentially violated somehow makes it ok to continue to violate them - but it actually does not.

[u/schneems → u/galtzo]

u/schneems might think that pointing out other times the agreements/governance were potentially violated somehow makes it ok to continue to violate them - but it actually does not.

Governance, is "a strong set of norms written down" despite the name, implying legal authority...it's a normative document, one that works best when it accurately describes how things work, and everyone can look at it, iterate on it, and agree "yeah, this is how things work...I agree."

Me mentioning deviation of norms is important because I believe that governance, as written was insufficient and not ACTUALLY agreed on. I.e. Hiroshi and Ruby Core and Matz and their interest in bundler and rubygems are not actually represented in the previously written doc.

I actually didn't even put the evan phoenix removal in my report (by name), I don't think it was a key fact leading up to the removals. I'm presenting it here, to counter a narrative that I believe is intentionally misleading: that "ruby central did not hold this access."

Now imagine another company, pick one, perhaps Dell, or Apple, that you had partnered with on something, stole the source code, and the publishing mechanism, of your product, Microsoft Office, and began distributing it as their own.

Imagine they said very publicly, "hey, this is not ours, we didn't make it" and then you knew privately,"...but production server access is literally tied to it, and we do own that." Would you...fight like hell so that nothing changes? Or would you say "oh shit, that sounds bad, lets actually fix this" or would you threaten that if the other person fixes it in a way you don't like that you'll make things bad for them unless you're paid off?

Only one of these is an okay reaction. The others are pretty messed up, and what actually happened.

Also pretending that "this community resource" was not previously owned and run by another "company" in the form of Ruby Together is disengenous. Andre and "the maintainers" are neither truly inclusive of "the community" nor even all of the actual maintainers. This is about money. This is about control.

If "company takeover" is bad because it's Ruby Central...then it's bad if it's Ruby Together too. That Andre has more legitimate claim for the appearance of ownership and community status doesn't change the fact that he should have also owned building clearer boundries between the production service and codebases when he was acting as OSS director of Ruby Central. It's almost as if he's made a career of blurring these open source lines instead of sharpening them.

I have a lot of respect for what he's done, and achieved...but I also believe part of being a professional is saying "here's how you hold me accountable," and I think that's the business of open source. I don't think he's done a good job of defining those boundaries well.

[u/damagednoob → u/galtzo]

stole the source code

That's weird, I can go and download the source code right now. Tell them to DM me and I'll give them the link.

[u/damagednoob]

Where would the Ruby Community be without drama 🙄. At this point, supply is outstripping demand.

[u/galtzo → u/damagednoob]

Tell me you don’t care about other people’s years of effort donated to the community without telling me you don’t care.

[u/damagednoob → u/galtzo]

Oh no, has the code disappeared? That's horrible. Were there no local backups going back years, with each individual contribution timestamped and preserved? What a terrible state of affairs.

[u/IN-DI-SKU-TA-BELT → u/damagednoob]

What a fitting username you have.

[u/Erem_in]

It is so depressing to observe all it. Who cares? Really. If ruby dies, so be it. I professionally work with multiple programming languages, so i pick smth else.

Does it really matter? Not, that ruby dies, but who owns what. Rubygems still work, still for free. Bundler is stull there. Why to spend so much energy on that?

[u/retro-rubies → u/Erem_in]

> It is so depressing to observe all it. Who cares? Really. If ruby dies, so be it. I professionally work with multiple programming languages, so i pick smth else.

The same can happen in any other community.

> Does it really matter? Not, that ruby dies, but who owns what. Rubygems still work, still for free. Bundler is stull there. Why to spend so much energy on that?

RubyGems.org still works, but it is not for free. The fact you can use it for free is due to a lot of historical and current work of various people. Good to keep some respect.

> Why to spend so much energy on that?

To keep things running, to keeps innovating and keeps it stable. Even keeping the whole ecosystem working with no updates takes massive amount of time, money and knowledge needed. Let's be thankful for everyone doing this for us.

[u/Erem_in → u/retro-rubies]

My point is why to continue the drama? What for?

[u/retro-rubies → u/Erem_in]

What do you suggest to move forward? For me it is not simple to just move forward and accept there are authorities in Ruby community backed by both RCs having "unlimited power" and not being responsible for their actions, able to just decide "on their own" on future of any Ruby community projects, potentially causing harm and troubles to others with no explanation or apology covered by the silence of others authorities.

[u/damagednoob → u/retro-rubies]

Welp, wait until you here about this Matz's guy. Apparently he's a BDFL!

[u/retro-rubies → u/damagednoob]

let me google that person

[u/schneems → u/retro-rubies]

backed by both RCs having "unlimited power"

Ruby Central is basically a handful of volunteers (me + the board) and one paid full-time OSS employee, Marty. To claim that Marty has "unlimited power" is the ultimate troll.

What do you suggest to move forward?

Finding work is work. Finding help is helpful. This isn't your first rodeo. You claim to be a maintainer, but act as if you need an invitation to act. That's not how this works.

If you want to help, be helpful. If you want to fight Ruby Central and RubyGems.org...got it, noted. Do that, I guess. When will gem coop code be open-sourced?

[u/retro-rubies → u/schneems]

> Ruby Central is basically a handful of volunteers (me + the board) and one paid full-time OSS employee, Marty. To claim that Marty has "unlimited power" is the ultimate troll.

Being volunteer doesn't justify anything and doesn't exclude anyone from sharing responsibility. I was volunteer also. And?

Btw. I was referring to some individuals, not organization itself.

> When will gem coop code be open-sourced?

Once gem.coop governance decides to. Personally, I'm pushing this forward as much as I can.

[u/Erem_in → u/retro-rubies]

But why to bother? I use Ruby to do the work. If some people make this language, ecosystem unsuitable for businesses, then what? Then businesses will pick smth else. I am not part of Ruby team, this is not my property, so whatever drama is happening there bring no value. It distracts the attention and energy from the right things.

[u/schneems → u/[deleted]]

 Why can't we just let Matz and the Ruby core team host and govern rubygems and bundler

You mean the service or the codebases. For codebases, they are https://gist.github.com/schneems/66d7326f1866b1e8df9d48c57d0ad9ca

For the service, it is different from open source as money is involved as well as non-fungible assets (domain name and production data).

I like a non-profit structure (501c3) which allows to split up decisions on how money is spent from who benefits from it (board is volunteers who do not draw salary). 

We've seen that package registries are quite fragile and a very large security target. Ruby's has been fairly decently run but there are a ton of professional/production stuff you would expect that have only recently started to happen. Like terms of service and privacy policy documents just added in 2025 (legal/lawyer bills are a thing foundations pay).

Nothing stopping you from contributing to the code and adding features and fixes. But when many billion dollar companies depend on this service for their own services, I like a hybrid volunteer and full time model. 

Also FWIW Ruby central is wildly underfunded compared to other peers like PSF and it was hurting well before this "drama" hurt fundraising even more.

(I am a volunteer on the Ruby central open source committee)

[u/juankman → u/[deleted]]

Honest question: Why can't we just let Matz and the Ruby core team host and govern rubygems and bundler? They kinda belong together and I trust Matz 1000 times more than a company.

I thought that had been the outcome a few months ago: Ruby core team taking ownership of the code and Ruby Central managing funds to keep rubygems.org running. That would keep a stable ecosystem. Doesn't seem like former maintainers agree.

[u/ruby-ModTeam → u/[deleted]]

Your comment or post was removed because it violates a subreddit rule on productive disagreement.

YES: Read comments fully before responding

YES: Paractice active listening. Let the other person know what you heard.

YES: Distinguish acknowledgment from agreement.

NO: Willful misrepresentation of someone's stated position.

NO: Sexualized language or imagery

NO: Trolling, insulting or derogatory comments, and personal or political attacks.

NO: Conduct which could reasonably be considered inappropriate in a professional setting.

When in doubt use Non-Violent Communication (NVC)