Bundler Belongs to the Ruby Community | Hacker News Reader

Bundler Belongs to the Ruby Community

andre.arko.net

373 pointsciconia65 comments

I appreciated the tone of this post. Not breathlessly inflammatory. Not longer than it needed to be. Just context, facts and actions.

RC's funding ( partially from sponsors like Shopify, not just conferences ) was allegedly conditional on this takeover.

Arko registered the Bundler trademark to prevent this corporate capture and plans to give it to a new, truly community-governed organization.

The biggest risk is the loss of long-time maintainers and a resulting community split/forking of key infra. Total mess.

> back when “Carlhuda” was a super-prolific author of Ruby libraries, including most of the work to modularize Rails for version 3

Wow, hadn't thought about that in a while. For a laugh, go back and take a look at some of the architectural choices they were replacing.

I haven't used ruby in more than a decade, but I remember there was always some controversy around the corner. Up next: Zed Shaw comes out from his cave, joins forces with the mummy of _why to combat DHH's anti-woke agenda.

Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover

https://news.ycombinator.com/item?id=45348390

Ruby Central's Attack on RubyGems

https://news.ycombinator.com/item?id=45299170

A board member's perspective of the RubyGems controversy

https://news.ycombinator.com/item?id=45325792

I'm leaving Ruby Central

https://news.ycombinator.com/item?id=45352432

Interesting.

> I have registered my existing trademark on the Bundler project.

As all of this was happening I had wondered if there was going to be some kind of copyright dispute, but I guess it's gonna be trademark based.

Does anyone have any insights into how this might play out? How do trademark disputes tend to happen? (I assume this is in the US?)

After fifteen years of not enforcing the trademark, a common legal interpretation in case of a conflict would be to consider the trademark genericized or abandoned. Which means any trademark owners apparently were not interested in enforcing their trademarks and effectively abandoned their rights.

Of course this is not guaranteed and just a common interpretation of trademark law by judges in trademark related cases. In case of conflicts, the trademark owner would be unlikely to win for this reason if a defendent can argue that the trademark was abandoned for years.

Oracle is in the same boat with Javascript. Technically they own the trademark. But world+dog has been using that trademark freely without them doing anything about it. So, their claims to the trademark are weak at this point. Hence the recent articles about e.g. Deno wanting to challenge their ownership of that trademark.

And you are right to call out the jurisdiction. Because interpretations and laws vary between countries and even between states inside the US. This stuff is complicated.

There's a reasonable argument that the trademark hasn't been generalized or abandoned. There's not other project out there using the RubyGems trademark (as far as I know). As such, OP has a decent argument that there were no previous violations in need of enforcement. Until a week ago, the trademark was (arguably) being used by a community owned project as desired.

> Until a week ago, the trademark was (arguably) being used by a community owned project as desired.

The community isn’t a legal entity. Saying that it’s owned by a public community with no boundaries or membership is equivalent to saying it’s genericized or abandoned.

Even if it was, that would undermine this trademark registration which was registered by a single individual.

that wouldn't matter though, would it? a genericized trademark is not the problem. the problem is ruby central wanting to take control of the name/trademark. if they want the trademark now, they now have to fight, and if in that fight, it is established that nobody gets to own the trademark, then the current trademark registration would have achieved its goal.

If nobody owns the trademark then they're free to use it.

The person who wrote this post tried to register the trademark to prevent them from using it. If the trademark is determined to be abandoned and generic then they cannot stop Ruby Central from using it.

but ruby central using the trademark is not the problem. as long as everyone else can use it too. but ruby central wants to prevent everyone else to use it, and that's the problem.

if the trademark is determined to be generic, then ruby central can not prevent anyone from using it.

the goal is not to stop ruby central from using the trademark. the goal is to stop them from claiming ownership.

I think the point is to prevent Ruby Central from owning it, not using it

> owned by a public community with no boundaries or membership is

membership in github org is still a membership

A GitHub org is not a legal entity.

Further complicating the issue is that for as long as I can remember, the two organizations have been kind of comingled at Ruby conferences, taking money. You want a Bundler sticker? Go to the Ruby Central table. You want a Bundler t-shirt? They'll happily sell you one for a donation. IANAL, but there has to be some nuance to "ownership" based on how it's presented to those who didn't read the fine print.

And, yet, it seems to still be difficult to do anything about it, with Deno now raising $200k to fight it. Ultimately, someone still needs deep enough pockets to push the point even if the legal point seems straightforward.

There can only be “nonenforcement” if there was someone using the “Bundler” name without permission that went ignored. You can’t enforce something that isn’t being violated. And unless I missed something, that never happened until RubyCentral pulled this takeover.

My (not-a-lawyer) understanding is that a trademark is 'genericized' only when it's become so ubiquitous that its public use no longer refers to a single, unique source or origin of product, but to an entire generic class of products: escalator, granola, trampoline are some older examples of 'genericized' trademarks.

In this case, 'Bundler' still refers pretty clearly to a single brand-name utility within the Ruby ecosystem. However, the goods/services in the trademark registration application [1] covers "Downloadable computer software for managing, processing, optimizing, and organizing source code and dependencies", which is a broader class of services. The descriptive word "bundler" is quite widely used in the JavaScript ecosystem, for example, to describe this general type of dependency-management software (esbuild calls itself "An extremely fast bundler for the web", for example). I could certainly see the "Bundler" trademark being contested as a descriptive mark that hasn't acquired significant secondary meaning in that broader context, so it will be interesting to see whether this trademark application is upheld upon review (or potential opposition).

[1] https://tsdr.uspto.gov/#caseNumber=99407082&caseSearchType=U...

Has there been any attempt from Ruby Central to undo the damage they caused? Can anyone comment on the current state of affairs?

Still waiting for them to reschedule the Zoom call they were going to do with the community.... something tells me we'll be waiting for a while.

Maybe they're waiting till after Yom Kippur? ;-)

This makes sense, since there won’t be a community left to have a call with if they don’t get their shit together.

I think this was the last statement from Ruby Central: https://youtu.be/VyCiE3GjQps?si=QgY1sa_w-59jJjQ3

This topic seems to be in a holding pattern now. People are waiting to see how Ruby Central responds. Some are hoping for the Q&A to be rescheduled or at least another statement

In this, the year of someone's lord 2025, surely there's a non-video version, right?

Probably on Discord.

The YouTube video may have a transcript.

There was a Gist posted of the transcript: https://gist.github.com/schneems/8f5179c8fa3d57cb6025d9e62c1...

same as previous written statements

blah, blah, strengthening governance, blah, blah

again, conflating code and rubygems.org service

anyway it's about "protecting the Ruby community"

I also fact checked that video here. https://joel.drapper.me/p/ruby-central-fact-check/

> I know for a fact that Ruby Central knew that it had no right to take over the RubyGems open source properties. I know this from speaking to the people involved and I have video evidence that Ruby Central knew.

Wow.

For a video claiming to have a timeline was awfully short on dates.

Weird, seems like a lot of ugly publicity to create more work for themselves. I wonder why Shopify chose to do this.

DHH got tired of having to argue with the bundler/rubygems community and decided to take it over so everyone working on it, worked for him, and had to take his orders (through his racing buddy, the Shopify CEO).

> I have registered my existing trademark on the Bundler project.

Can someone familiar with trademark law comment on this? If I understand this post correctly, there was a merger between Ruby Together and Ruby Central at some point in the past. The combined organization was paying for some combination of developer time and server costs for the project.

Can an individual member of this merger actually go register the trademark for the project name and claim that it belongs only to them after merging the organizations and working on the project together, including financial contributions? Is this a loophole situation where neglecting to register a trademark for the group organization left an opening for someone (who is a member of the combined organization) to come in and scoop the trademark registration for themself later? After a decade of the word being used generically by the community, can anyone suddenly trademark it and claim it wasn’t a generic term at this point? Have I misunderstood something about the order of events or nature of the merger?

Seems like this is the reply you wanted: https://news.ycombinator.com/item?id=45372303

Careful or the big companies will copyright and trademark "Ruby Community", and it'll belong to them.

I realize this will come off as snide, and result in downvotes, but looking to the success of Ruby and Rails today, the "community" is as much the money that's been poured into the ecosystem as it is the warm fuzzies and volunteers. Without the millions of dollars companies like Heroku, Shopify, Basecamp, Github, 37 Signals, and others have spent in terms of money and developer-hours, the projects we know and love would be in a much different place. To that end, those entities are as much the "community" as the developer who has done nothing but "gem install" and put cute stickers on their laptop.

I can't tell what point you're trying to make here?

That dismissing the concerns of organizations, big and small, that have contributed to Ruby's success is intellectually dishonest.

I think you are spot on here, although many may not like to acknowledge it.

I'm having trouble finding a specific meaning here. Has some concern been dismissed? By who?

Which organizations that you mentioned (Heroku, Shopify, Basecamp, Github, 37 Signals) have been dismissed? This post seems focused on Ruby Together & Ruby Central and struggles within.

> Heroku, Shopify, Basecamp, Github, 37 Signals, and others have spent in terms of money and developer-hours

Companies are legal fictions that we allow to exist. The _people_ are the ones who did the development, management, and all the other things that had to be done.

The companies may have _paid their salaries to do so_ but there are plenty of open source communities that exist without the direct funding of work.

This splitting of hairs between the legal entities and the work of their paid teams/employees isn’t adding strength to your argument. Companies are run by people and those people get to make decisions on the allocation of resources. If they decided to put substantial resources into OSS, the company does get to claim credit there.

> there are plenty of open source communities that exist without the direct funding of work.

Great! Maybe the Ruby community can strive for this in the future but it does not reflect the OPs point that these companies and their outsized contributions via time and money are still core to the existing community we have today.

those entities are as much the "community"

sure, but the issue is that one of these entities now demands exclusive use of something that should be shared between them and others.

saying that "this belongs to the community" doesn't mean that this entity is not part of the community, but that they don't get to exclusively own something that should be owned by everyone.

I'm sure the developer community would have spent the money if we'd had it, but unfortunately ROI has not trickled down quite so far as promised.

Very unclear if you read the post and understood that the author is actually a full blown OSS contributor and maintainer - and the point of the post is that they built Bundler, which Ruby Central has now “stolen”.

It's MIT licensed legally there was nothing stolen.

That would only be the case if they forked it - but not a hostile takeover of the original repository.

But it wasn't a hostile takeover they were admins. Maybe GitHub has to provide more protection for the user that created the repository but nothing that happened was illegal. Which makes it worse in my opinion and shows that we have some deficits on the side of GitHub.

You're right. To me, "gem install" and "cute stickers" come off as snide remarks. Maybe that's partly because you directed those comments at someone who claims to have done major development work.

I sympathise with the author, I really do. He’s obviously put in 15 years of work on this, and he’s engaging in a thoughtful, kind manner. The action on the trademark he’s taking is measured, and necessary.

But I don’t know if I agree with the title. It says bundler belongs to the ruby community. It should, certainly. But right now it belongs to the rich people who fund the work on Ruby and Rails. That’s DHH and Lutke (Shopify CEO).

Whether the community wrests control from them remains to be seen.

> But right now it belongs to the rich people who fund the work on Ruby and Rails. That’s DHH and Lutke (Shopify CEO).

Do you mean "right now" as in _now that they hijacked the Github repositories and locked out the previous owners_, or "right now" as in _for some time now, since they've been funding some Ruby work_?

The latter, they controlled it by funding maintainers. But the extent of their power and their lack of restraint in exercising that power only became clear now. DHH and Lutke don’t have the community’s best interests at heart.

Funding open source work doesn’t confer ownership, but also “they controlled it by funding maintainers” is not true —- many other companies and individuals from the community helped fund the work through Ruby Together and later Ruby Central.

I believe the events of the last few days speak for themselves. Shopify has exerted absolute control over important Ruby infra. Shopify’s CEO? Lutke. And Board member? DHH.

Yes, that is a recent development. And many of Ruby Central’s other sponsors and sustaining members are upset about it.

> Funding open source work doesn’t confer ownership

A true donation wouldn’t confer ownership, but in this case there are actual organizations and legal structures involved that did confer ownership.

Please explain - which organizations and legal structures, and how did they confer ownership? Be specific.

It's explained in the article with a direct link to the merger agreement

https://andre.arko.net/2025/09/25/bundler-belongs-to-the-rub...

You clearly haven't read the article or the merger agreement.

> DHH and Lutke don’t have the community’s best interests at heart.

How does this manifest?

No, the point is that it doesn't belong to them. They can’t just wrest control of a GitHub repo and claim they own it.

Reply on news.ycombinator.com