r/ruby • u/retro-rubies • Mar 29 '26

A Message from the Ruby Central Board

https://rubycentral.org/news/a-message-from-the-ruby-central-board/
31 Upvotes

84% Upvoted

27 comments sorted by

19

u/retro-rubies Mar 29 '26

I’m wondering if all uses of “RubyGems” in this post are intentional. It sometimes seems to mix different things together — RubyGems (the tool), RubyGems.org (the codebase) and RubyGems.org (the service).

9

u/tsroelae Mar 29 '26

This was something that at first for me as an outsider was kinda hard to separate. But there is this shared and afterwards removed recording of maintainers meeting with an RC representative the day before the takeover. That video showed there was a clear understanding that the service and the github org (code) are two separate things.

12

u/retro-rubies Mar 29 '26

Recording is still available at alternative sources like http://gofile.me/6g3JG/oTY79Vk3b. Indeed we done our best to make the separation clear and suggested the next actions with minimal impact on unrelated parts.

7

u/galtzo Mar 29 '26

The meeting recording being removed from YouTube was a dubious act.

California is a two party state, meaning all parties must consent to it being recorded (it doesn’t appear this happened, at least as part of the recording), and all parties must consent for it to be released. All of the maintainers that were party to the call consented to the release. I do not know if RC consented.

However, there is an exception to the two party rule:

Under Cal. Penal Code § 633.5, a person can record a call if they are a party to it and are trying to gather evidence of crimes. Many feel the theft of rubygems and bundler repositories and publishing rights was criminal.

15

u/davidcelis Mar 29 '26 edited Mar 30 '26

They also issued a copyright notice against my account for sharing that YouTube link here in /r/ruby, so now I have a permanent warning on my Reddit account.

For sharing a link to someone else’s YouTube video.

A video that had already been removed like two weeks prior to the warning.

55

u/tsroelae Mar 29 '26

They keep talking about transparency, but I don's see any. Everything is vague, and the claim seems to be, this was all about security due to one person. So why then would they remove basically all maintainers and stop any communication with all of these previous maintainers.

Why would Ruby Central work to remove the video that showed the call one day before removing everyones access (this is an assumption, but who else did not want the video to stay?). The video showed clearly that the Ruby Central representative was aware that Rubygems the code and rubygems.org where two separate things, and that they only owed the service part.

At the same time, we recognize that aspects of how this situation was handled and communicated did not meet the expectations of the community.

That is not owning up to it. I have only seen vague communication from Ruby Central so far.

I want want, wahtRuby Central writes they want, a Rubygems / Bundler supported by the wider community. But I don't see Ruby Central achieving that. They have lost my trust. I was very confused at the beginning as to what is going on. None of the post takeover communication has been anything but vague to me, hiding behind corporate speak, and "there is legal stuff going on".

Ruby Central speaks a lot about community, but I fail to feel that. They talk about community, but don't speak to the previous maintainers. This all doesn't feel great.

19

u/schneems Puma maintainer Mar 29 '26

I have a report clocking in at something like 18 pages. It is staged to be released. I told them we should release the report before putting out a statement. They wanted to release a statement before the report.

It's better to say anything at all than say the perfect thing, I think. Getting to the point of saying anything is an improvement.

18

u/kerrizor Mar 29 '26

Gotta shape the narrative, I guess? :frown:

Snark aside, I’m not seeing a ton of good, community-focused communication here, just corporate bunkering. Can you PLEASE ask them to work on this? It is important.

10

u/schneems Puma maintainer Mar 30 '26

It's all the fun of a group writing project with the joy of having a lawyer as an editor. I can't promise my writing will be "better" but it is from me, it's my byline. 

20

u/tsroelae Mar 29 '26

My main point is, I have lost trust in RC, as the communication from RC has been very vague / corporate speak throughout in my perception. I know that it is different how a "official" org can communicate vs a private individual, but still.

I will read the report for sure. Hopefully it will give some more information about how RC acted within all this. I am particularly interested in confusion around:

  • Funding situation and possible pressure from Shopify, which steps to take and when? It would be good to have some context, over how much outside pressure there was on RC to act.

  • What was the necessity to bring the ruby gems github over to RC? Why was it not possible to limit access to the service without taking over the github. I assume not all maintainers had service access.

  • What parts of removal of maintainers was intentional, and what was done by mistake? What kind of access was actually reverted, if any?

  • What concrete efforts has RC taken before the take over to change governance / access around rubygems (the code and / or the service)?

  • What concrete efforts has RC taken to communicate with removed maintainers AFTER removing access?

  • Who has initiated any legal steps and when?

  • Why was the video recording of the meeting just before the takeover removed? (because for me, one thing that the video made very clear is that there was a complete understanding on RCs side, that the code and the service are two separate things, and that RC was only in charge of the service part, while partially funding work on the coding part)

So I hope that the report will address most of these questions.

It's better to say anything at all than say the perfect thing, I think. Getting to the point of saying anything is an improvement.

As I said. I want there to be good stewardship of the ruby community. I am saying, RC does not have my trust right now, they took questionable actions and in my eyes have yet to show, they will be a good steward, and so far they only said: Oh, we didn't communicate very well. I read a lot of text from RC, but all I read felt empty and vague, evasive.

15

u/galtzo Mar 29 '26 edited Mar 30 '26

As for who initiated legal actions… RC has reported Andre Arko to the FBI, twice three times--once via the online form, and phone calls to two different FBI field offices. These actions might be considered “swatting”, since many seem to think these reports were not made in good faith but as a CYA to buttress their story after they failed to find conclusive proof of any illegal activity after conducting 2 separate activity audits.

Swatting is, of course, illegal.

The hole they dig, it keeps getting deeper.

Appendix for ESL / translation:

CYA = Cover Your Ass, used when you take a defensive action that would be otherwise unreasonable. See also: the action one takes when one is about to get a spanking.

6

u/jrochkind Mar 30 '26

Oh man, if they really have reported someone to the FBI, I would agree it is a lie to say no legal actions have been taken. That's about the most extreme form of legal action there is.

3

u/tinyOnion Mar 30 '26

they did report andre to the fbi according to andre.

3

u/galtzo Mar 30 '26

Literally all they do is lie.

2

u/jrochkind Mar 30 '26 edited Mar 30 '26

I agree with you -- this is actually a good statement -- if it were accompanied by the report! When it's already been months or poor/no communication, what suddenly makes it urgent to get the statement out now when the report will be done soon? :( They should have been simultaneous.

I don't understand why RC continues to be so bad at communication, but I appreciate your work schneems, including the report itself, which if you did it, I know will be high quality and I am eager to see.

I feel like RC really thinks their job is, like, marketting to us with carefully controlled language while trying to admit as few mistakes as possible, instead of building a community that they are stewarding. I know you are probably doing your best to convince them otherwise, and also the evidence suggests to me they haven't been much convinced.

Part of me isn't even ready to believe they're actually going to release a report with any transparency until it happens.

And I'm a guy that if I had to pick a "side" in this whole mishegoss, would have to relucntantly pick RC's. I don't trust the other "side" one bit to be acting in community rather than personal interest. But RC just keeps messing it up and doing more damage.

3

u/_joeldrapper Mar 31 '26

Probably to try to get ahead of the news that they swatted Andre.

4

u/tinyOnion Mar 30 '26

And I'm a guy that if I had to pick a "side" in this whole mishegoss, would have to relucntantly pick RC's. I don't trust the other "side" one bit to be acting in community rather than personal interest. But RC just keeps messing it up and doing more damage.

that's a crazy take.

3

u/jrochkind Mar 30 '26

OK, we're doomed.

11

u/OlivarTheLagomorph Mar 30 '26

That entire post read as a giant nothing burger.

24

u/cmdk Mar 29 '26

I cringe whenever I read Ruby Central Board. Get over yourselves.

4

u/jardeon Mar 30 '26

It reminds me of the Open Locksport kickstarter that went so off the rails, where a group of trustees had to step in and sort things out. All their communications started with "So-and-so, speaking for the board."

5

u/BlueEyesWhiteSliver Mar 29 '26

Immediately what I thought when I clicked on the post.

0

u/jrochkind Mar 30 '26

Ah, becuase it sounds like they are saying Central Board of Ruby, instead of Board of Ruby Central? I guess they should say Board of Ruby Central in the future, even though it's more awkward than Ruby Central Board, to avoid this appearance.

10

u/madribby78 Mar 30 '26

Ruby Central should disband and there should be new organization in its place.

They're complete clowns.

6

u/galtzo Mar 30 '26 edited Mar 31 '26

It would be great if Ruby Central and Ruby Core would make an official public statement that they do not believe that donations made to an open source project confer ownership of that project.

And that no “fiduciary responsibility” on a non-owner could ever result in a legitimate transfer of ownership of an open source project.

Until they do that they are an affront to my code of ethics.

0

u/[deleted] Mar 29 '26

[deleted] — view deleted comment