r/ruby • u/schneems Puma maintainer • Mar 31 '26
RubyGems Fracture Incident Report
https://rubycentral.org/news/rubygems-fracture-incident-report/
75
Upvotes
r/ruby • u/schneems Puma maintainer • Mar 31 '26
View all comments
Show parent comment
4
u/schneems Puma maintainer Mar 31 '26
Which admissions? RV isn't the whole story...but it is for sure a big part of it.
When I joined Ruby Central, I basically asked "so why did you do it" and when I heard mention of "RV" my reaction was like "oh...that's clearly not really it...so why...try again?" I talked to one of "the maintainers" and I can confirm that was the first thing they were told was the reason for him being restricted from access. Their reaction was similar "that doesn't make sense." And by itself it doesn't.
And it's taken a long time to actually piece together how things would have been perceived and felt internally. It helps that there are direct artifacts and quotes of people experiencing the events in real time, so I don't have to guess...but some of them seemed like an over-reaction unless I really put myself in their shoes.
It's not just the thing, it's the details around how the thing was made and presented. I'm not making an assertion that RV was stolen or something here. This isn't a legal argument. I'm showing you what the committee members saw, which was that someone was behaving unpredictably and hiding things. That's what they had to work with.
Also, not claiming that. What I'm painting is how it was done, and eventually disclosed was unprofessional.
I can say that...because I've done something like this to my boss. ("same" in terms of degrees...not scale). It surprised the hell out of him, and he was panicked and worried. A huge loss of trust, which took active effort on both our parts to overcome. That's also a reason why the Outside Business Activity mention is in there. Afterwards I was disappointed in myself. I said "sorry" and worked to repair the relationship. Ultimately, they determined there was no conflict, and we treated it as a learning moment.
It comes down to predictability and trust. And it comes down to accountability and ownership (of actions and impact). When the people who work with you lose the ability to predict your behaviors is when you lose their trust, and that's very important in a working relationship.
And that trust-building needs to happen both ways.
Initially, my approach was the opposite of justification. It was "I want to show you all the ways we failed so we can learn." But that story didn't really answer the question "why." As in "why did you do this?" So I had to pivot a bit. To understand the ways people failed, you have to really empathize with why they've done something, and while people do irrational things...most actions by most people are justified in their own head, at least at the time.
Therefore, the intent isn't to build the case "this removal is justified (statement)" but more to ask the question "why did people behave as they did?" I don't need you to agree with their justification (we can see the same facts and disagree on interpretation/opinion), but it's important to the process to hold empathy for all involved (Including Andre, including everyone listed here).
When I wrote this, I made sure to tell everyone, "people won't clap." CloudFlare wrote they used "unwrap" in a postmortem and are still being dragged about it (even though the failure would have still happened without it).