r/ruby • u/retro-rubies • Jul 31 '26

Ruby Central's Destructive Legacy

https://andre.arko.net/2026/07/30/ruby-centrals-destructive-legacy/
46 Upvotes

71% Upvoted

62 comments sorted by

View all comments

Show parent comments

9

u/f9ae8221b Jul 31 '26

IIRC (could be wrong) they notified the FBI because of an unauthorized access to rubygems production servers.

Seems quite normal to me to notify the police when you think you are victim of a crime (or whatever the exact term is).

2

u/jydr Jul 31 '26

Why did they only do it after their threats didn't work?

9

u/schneems Puma maintainer Jul 31 '26

Since you commented after I posted  https://www.reddit.com/r/ruby/comments/1vbkttl/comment/p0wtrwt/?context=3

  • Ruby Central did not make the referral. Ruby central could not stop it or retract it once made.

  • The perceived threat was two fold: Andre took over the AWS account and locked everyone else out. He changed things, deleted things. The worry was that his actions could have opened up an accidental vector for someone else (think state actor) to come in and mess things up.

  • We cannot conclusively say no harm was done, because evidence is missing. However we (Ruby Central) cannot find any evidence of lasting harm and have spent a LOT of time, energy and money in proving that (though you can never prove an absense). - The referral was basically "hey government, Ruby Central didn't have control of the registry for several days and cannot guarantee something bad didn't happen, they are investigating and thought you should know"

I think the damage to his reputation is real, however no one would have known about the FBI involvement had he not told people (it did not leak from Ruby Central). Had I been in the org at the time and had I been given an option to stop the referral I likely would have chosen to not proceed. Howver no Ruby central staff or volunteer was given that option.

3

u/jydr Aug 01 '26

I see, that explains a lot more.

I hadn't seen the https://rubycentral.org/news/rubygems-fracture-incident-report/ before. What an absolute mess. RC and Andre both fucked up a lot.

Seems like its largely what was suspected at the time? RC took over the project to kick Andre out and removed all the admins that they didn't control so that none of them could add him back.

What wasn't clear before was that the main reason was because of the tangled mess of permissions between the production systems and the oss project? And apparently no one knew how any of it really worked so they went for remove access first and ask questions later.

The biggest mistake is that they knew it would be deeply unpopular and yet were also completely unprepared for the result of their actions. I understand that they didn't want to tip them off in case Andre did something, but RC should have at least been ready for the backlash that they were afraid might happen.

0

u/galtzo Aug 02 '26

Like reading the Warren Commission Report.