* DHH said some things on his blog that some people believe to be deeply racist / fascist (not going to unpack whether they were or not because answering that question is irrelevant to the fact pattern; consult other threads for that debate).
* A Ruby conference run by Ruby Central was asked to deplatform him. Since he's the creator of Rails, they declined.
* In response to their decision, a major sponsor (Sidekiq) pulled out of supporting the conference and Ruby Central in general, to the tune of $250k a year.
* This created a "blood in the water" situation where Shopify hit Ruby Central with an ultimatum: they would back-fill the lost sponsorship for oversight control of Ruby Central (and the gem repository they maintain, rubygems.org). And if Ruby Central didn't take the deal, Shopify was going to pull their funding also, leaving them in dire straits (this, BTW, is a fairly common corporate tactic when multiple partners share support of a service that doesn't independently generate revenue. Look for it in your own business, startup company, and nonprofit dealings!).
* Shopify now de-facto controls rubygems.org and people immediately started backing towards the exits because corporate takeover tends to be a harbinger of enshittification. As if to prove the point, Shopify's folks immediately ham-fisted the access controls, yanking several gem creators from the admin roles of the gems they created. They claim this was a mistake; several in the community do not want to give them a benefit of the doubt they are not believed to have earned.
* Community members are standing up gem.coop as an alternative gem repository.
> When they finally did reply, they seem to have developed some sort of theory that I was interested in “access to PII”, which is entirely false. I have no interest in any PII, commercially or otherwise. As my private email published by Ruby Central demonstrates, my entire proposal was based solely on company-level information, with no information about individuals included in any way. Here’s their response, over three days later.
At this point, it's probable that any attempt to just list the pertinent events isn't going to end up being as neutral as one might hope because even the choice of what context to include or exclude is itself editorial. This is the same lesson people might learn in a high school history class, just applied to something much more recent.
Perfect neutrality is unachievable but that doesn't mean that every possible way of presenting the facts is equally valid, or even that it's impossible to distinguish presentations that are or aren't missing important context (see, e.g., the surprising success of Twitter's Community Notes).
Unfortunately for him he basically admitted to a crime because it came after he was terminated. He tried appealing to community and whatnot but anyone who's ever worked for a corporation knows that once you're terminated, it doesn't matter if HR forgot to take away your credentials or not, you simply don't attempt to access anything ever again. Having keys to something doesn't make you the owner.
At the same time, why didn't RC call him to ask? Was it easier to write about a security INCIDENT throwing shade at Arko?
With that said, let's keep focused on the real issue: RC did a hostile takeover of the projects. That's not been properly disputed so far. Matz is, therefore, accepting to steward stolen projects.
> Matz is, therefore, accepting to steward stolen projects.
You know Arko didn't even start working on Rubygems until it was nearly 10 years old, right?
One of the original authors is in here and on X saying he supports it being taken over by RubyCore. Which matters much more than whatever the maintainers who were locked out think.
Arko already stated that he didn't know he had been fired. Geez.
> You know Arko didn't even start working on Rubygems until it was nearly 10 years old, right?
The project was stolen from a set of maintainers, not just Arko. Let's stick to the facts: someone with admin rights over the repos revoked the access of other admins without their consent. What do you call this?
> One of the original authors is in here and on X saying he supports it being taken over by RubyCore. Which matters much more than whatever the maintainers who were locked out think.
How in the world is that relevant? I have a lot of respect for Rich, but he wasn't a maintainer.
LMAO
No. He's one of the few people on the planet that could lay claim to it's copyright. He also gave the insight that Rubygems has literally ALWAYS been a part of RubyCentral.
But if you do care about the repo, once again, RC has always controlled Rubygems. From the day it was written. The maintainers were even paid by RC. That makes it RC's, not the maintainers'.
https://andre.arko.net/2025/10/09/the-rubygems-security-inci...
"Please confirm that you cannot access the Ruby Central AWS root account credentials, either through the console or by access keys."
Alternatively, we could see the whole issue for what it is: a power struggle between political factions of an open source project that is unprofessionally handled by at least one side.
You’re likely aware, though it’s worth mentioning, that the new owners ousted all existing maintainers without any explanation[1]. This follows a prior incident where access was revoked and later restored, with assurances that it was a mistake. This situation can only be viewed as a malicious attack, in which only the new owners had a full understanding of what transpired. Changing the password was a reasonable and appropriate response that any competent person in a similar position would've considered.
I’m shocked that we seem to be experiencing a Freenode 2.0 situation, but with some supporting the usurpers instead of the longstanding maintainers. It’s only been four years since the Freenode debacle, yet certain types of people seem to have grown bolder since then. A "win" for freedom of expression, huh?
It’s telling that you can write multiple paragraphs claiming the moon is made of cheese while expecting others to communicate only in brief, misleading soundbites.
https://en.wikipedia.org/wiki/Loaded_question
Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.
Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they've decided must have happened. The person we're talking about here tried to (quietly!) monetize the server logs for RubyGems. Don't even try to play the "that's what RubyCentral says" card --- they published the email.
The world doesn't always line up with the most sympathetic principles.
Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash.
When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror.
And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.
These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.
When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror.
What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations.
> insinuate: to impart or suggest in an artful or indirect way
https://www.merriam-webster.com/dictionary/insinuated
Note the word "indirect."
Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
And why are you ignoring that RC did a hostile takeover of the repos? Again, RC stole the repos. What do you think of that?
I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have a professional interest in stories about people gaining unauthorized access to accounts. I assure you, the law doesn't weigh one party's transgression against the other the way you suggest it should.
And you know what? I think you're right! What Andre did could constitute a crime. Any serious organization would lawyer up and go after him... right? RIGHT?
What sort of monetisation?
Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(
To me that seems like a good idea, not like a betrayal of trust as some people have been making out.
Personally I also think the monetization proposal was silly, but that was in August and Ruby Central rejected it.
He logged into the root account because he thought he was on call and that someone was taking over Ruby Central, so he reacted in real time. With the obvious chaos and incompetence in Ruby Central and the ill defined takeover that does not seem far fetched.
What exactly would he have gained by openly changing the root account for malicious reasons? He knows he would have been found out. It is not even a hack.
The HN commentariat is really shocking me here, because everyone in the professional space that I talk to about this thinks this is obvious and takes the same position.
I won't follow the thought from there, but maybe you see where I'm going...
https://andre.arko.net/2025/10/09/the-rubygems-security-inci...
I'm only going by the corporate narrative structure of the director's post, who clearly wants to throw someone under the bus and cover up organizational incompetence. "Open" source has become so despicable.
"As this situation occurred, I was the primary on-call. My contractual, paid responsibility to Ruby Central was to defend the RubyGems.org service against potential threats."
For instance, DHH and his fancy blog, are not 100% related or relatable to RubyCentral ousting long-term developers. There may be some connection (DHH on shopify's board, tons of ruby developers being paid by shopify and still writing "my opinion is totally unbiased" like byroot did), but there is no 1:1 overlap. For instance, I could not care what DHH writes on his blog any less. rubygems.org changing policies though - that affects me. And if shopify is in part responsible, and DHH sits on shopify and makes decisions, then yes, something changed here. But there are also people who have a vendetta against DHH and they leak into other spaces too. I am not among those people and they shouldn't try to hijack other communities either.
By the way, the Shopify ultimatum also does not explain why all other ruby devs were ousted. Ruby Central lost the narrative here. And, since they accuse Arko as the ultimate bad boy - why haven't they sued him? Why do they continue to refuse to do so? (Because they know their case would be rubbish nonsense and they would have to open up ALL emails, which may make many more people suddenly ... very funky.)
It's related because it led to Sidekiq dropping their funding, which increased shopify's power over ruby central.
As someone who has sued someone else and won, it can take months for your legal team to gather the facts, decide on strategy, and then file suit.
You are alleging that Shopify was retaliating. Do you have any reliable context that Shopify was acting in a retaliatory manner?
Given the power dynamics, the burden of proof is on Shopify to proove it wasn't retaliating at the behest of, or in a misguided attempt to defend DHH's honor.
Per the concept of "innocent until proven guilty", there is no burden on Shopify to prove they didn't do what you believe. The burden is on you to provide evidence for the motivations behind their actions.
I personally doubt Tobi got Shopify to where it was by making rash decisions based on emotions and drama.
That's how a reasonable society works.
Your second para is appeal to authority. A former CEO of mine (not a billionaire though, but a mere centimillionaire) was a drama magnet, thin-skinned, and a vengeful little shit.
That’s just a way of saying “I don’t have any evidence of what I’m claiming”
I have seen the "soft-hostile takeover" executed in other contexts, however. I don't think it's necessary to presume DHH used his influence as a Shopify board member to seal the deal or that he would have ulterior motive in doing so; in my experience, it's sufficient for a company to see a valuable piece of a puzzle they care about go vulnerable to acquisition offers to make the offer (with the corresponding stick). I'm willing to be convinced otherwise in either direction if more information presents itself; all I know is that Shopify put the offer on the table "We'll back-fill your funding gap or we'll make it much worse; your call." And I've seen that offer made in a completely capitalism-red-in-tooth-and-claw "business is business" way in the past.
* DHH is not only considered racist / fascist due to some blog posts, but also for making Hyprland the default DE in Omarchy, developed by someone who goes by the name Vaxry Vaxerski, who is also considered fascist and racist, and thus banned from contributing to freedesktop projects due to supposed breach of CoC:
https://blog.vaxry.net/articles/2024-fdo-and-redhat
* Hyprland and all its contributors are now also considered fascist from taking sponsorship money from 37signals, DHH's company, due to it being an important part of Omarchy.
https://account.hypr.land/sponsors
* Due to the fact that both DHH and Vaxry are both considered fascist / racist, Framework and its CEO (yes, that Framework) are now considered to be supporters of fascism, because Framework is sponsoring and supporting both Omarchy and Hyprland.
https://account.hypr.land/sponsors
* Cloudflare (yes, that Cloudflare) is considered to support fascism because they support Omarchy and the Ladybird webbrowser (which is a project also run by someone considered to be a fascist)
https://blog.cloudflare.com/supporting-the-future-of-the-ope...
* Last but not least, Tobi (Shopify CEO) and thus Shopify are also considered by many to be supporters of fascism when this drama started to unroll for standing by DHH no matter what when activists wanted to deplatform and ban DHH from his own creation (Ruby on Rails). Which makes the Ruby Central drama due to the involvement of Shopify even more interesting:
https://xcancel.com/tobi/status/1970944464303923687
Me? I want to hop in a time machine back to the 90s/early 00s before all this crap started and everybody was just generally nice to each other.
This methodology is definitely not how you discover fascism. But it is how fascists and communists defined and traced their enemies in the 20th century.
While I am all for making conscious choices on what to support I can't take anything phrased like that seriously "all is contributors".
Hyprland, while inferior (imo) in some aspects to sway on the wayland tiling manager landscape is a fine piece of software that I use on my non-work computer (I still use sway for stability).
Back on the topic: I reiterate I'd be happy to avoid using or supporting projects based on non-purely technical issues (discussion on "pure technicality" omitted for brevity).
It's just... What, do I need to know every persons imo completely irrelevant opinions on whatever du jour hot political topic? Maybe the answer could be yes,
I would be fine with dropping Hyprland support, maybe I will after digging a bit more. But this whole thing just reeks to me of terminally informed and ragebaited people looking for a platform to vomit their completely irrelevant opinions, actions speak more (e.g. fostering a dangerous environment _adjacent to the project_ based on discrimination).
I just feel I want to nope out of this industry and everything related to it, it's very overwhelming.
No. But if they're using their social capital they've built via their software contributions (like DHH) to spread racist nonsense, then maybe it's worth considering alternatives, or at the very least, stop supporting those projects.
"should keep their bullshit to themselves" <---> "should perhaps take leadership and avoid having their public channel a cesspool" <---> "actively encourages/participates in discriminatory practices" <---> "raging maniac hurting people, rallying for X"
Specifically on the topic of RubyGems:
I couldn't care less about what DHH posts or not, I certainly care that he uses his position to influence a chain of actors to interfere with something that always worked just because X.
I couldn't care less about the other side on the "cancel" mission, I care about influencing a chain of actors to interfere with something that always worked just because Y.
Please quarantine your political polarization/culture wars bullshit, non-anglo countries don't need it.
People need to step back and breathe. It’s possible to feel one thing about a (frankly shite) blog post and its author without tarring everybody within six degrees of separation with the same brush, and it’s quite unsettling that people find such nuance so difficult.
The internet was never nice. It, however, did at one time require technical savvy to use. With that savvy came the understanding that computers and people aren't the same thing, so when the computer emitted something not nice you'd laughed at how quant the technology was instead of getting your emotions all tied up in a knot and try to hold a person accountable like those who have no idea about what's going on around them do.
We tried "Don't feed the trolls." It's how we got where we are now.
We may just be working under different definitions. Are you claiming that when I type things into, say, Hacker News and hit reply, the words you read aren't the words I wrote?
Or are you asserting the "person" of the words in the computer is not the same person I am behind the keyboard?
I'd argue that the latter is the disproven hypothesis. It turns out people who said awful things online were actually awful people; they may not show it as often in public, but they weren't different human beings. Broadly speaking, they believed the things they said and tended to act on them in real life.
Laughing off things on the computer as not real was how at least one shooting went unchecked.
> Ladybird webbrowser (which is a project also run by someone considered to be a fascist)
Do you mean awesomekling? Why is he considered a fascist?
There are definitely actual fascists in tech (like Curtis Yarvin) which I (centrist liberal, not a tankie) fully support deplatforming where possible, but why are they considered fascists?
I hope you can see this because my posts in this thread are getting attacked and downvoted.
This pretty much summarizes how it started (copied from Google):
https://lunduke.locals.com/post/5823666/ladybird-web-browser...
(note that while the exact word never is seen in evidence added to this post but it sure is or hinted towards elsewhere.)
and evidenced by this its ongoing:
https://xcancel.com/awesomekling/status/1971287738268909576
because some people disagree with things like this:
https://xcancel.com/awesomekling/status/1966456391146606806
And there are tons more posts that show that some people are not exactly nice towards him on his X timeline.
Also there's direct proof of these accusations out there but I will not link to those out of professional courtesy for those involved (yes, some people still have that).
It should also be noted Lunduke is also not neutral and has his own political agenda.
I prefer the Go solution where the package manager uses the git repos instead of a separate package index that might or might not correspond to the git repos.
> we gave stewardship of RubyGems
I didn't sign anything.
I also remember the original creators of rubygems. How old is Ruby Central? 10 years? 15 years? There were several years before that.
- Corporate entity doesn't have copyright over your creative output. Just because word can open and view ("run") your novel does not give them ownership.
- Locking your access completely on your resources would be akin to a ransomware attack or account compromise
Would you label those actions hostile? Or just accept it as right because "maintain security"?
If you would label the above hypothetical actions as hostile (if not outrageous overreach, something akin to theft?); what is fundamentally different to what Ruby Central did by taking over the source code of a GitHub repository?
The "maintainers" weren't volunteers. They were paid employees.
Also none of the ones complaining were the original authors of gem nor bundler.
You work for Microsoft as an independent contractor, as a night watchman/groundskeeper. So do a number of others. You were hired because you and your crew of weirdos were writing the story of advanced gardening and building maintenace; which people including those at many famous and powerful companies used and found useful. A number of years ago someone said "huh, maybe these guys should get funding", and a few others agree; and Microsoft ends up in charge of distributing that funding.
The above still happens. They have locked your computer with a ransomware message that says "we will give you back access if you get rid of one of you". To lock your computer, which is airgapped, it would require someone with admin privileges to your computer to walk in and manually do this. It turns out one of your has colleagues done this, added an account for the Director of Night Maintenance at Microsoft to your machine.
You and almost all of the "paid employees", again, a number of whom are independent contractors, resign in protest; leaving only the person who tampered with your computer.
https://bsky.app/profile/duckinator.bsky.social/post/3lz6exz...
> The behavior Ruby Central exhibited was so egregious that I sincerely thought someone's account had been compromised at one point
During this chaos; which all happened between September 9 and September 18;
- at midday LA time/2:40pm New York time; Microsoft terminates the contract with one specific individual; who was the one they demanded the group gets rid of if they wanted access back - 8 hours later, that person locks the doors; changes nothing else, etc.
Some basic analysis about the situation you need to do:
- Did the actions on September 19th, even if you believe it was a crime of the most serious nature, justify the actions on Sept 9-18 where Microsoft took access, said whoopsie, then did it again?
- Treating the Sept 19 actions as a crime; did the person who did it do so with a criminal intent? (Mens rea). Did they intend harm? Or were they indifferent to the harm caused? Should this be prosecuted, has that person provided justification or similar that could in any way be reasonable doubt?
- If the actions on September 19 are a crime in your viewpoint; would paying/influencing someone to lock the accounts of all of the maintainers also be a crime? Why or why not?
Note that you'll want to read https://www.law.cornell.edu/uscode/text/18/1030
First off, was anything involved a "protected computer"? No, probably not, not by the legal definition there; yes by what we as laypeople would assume.
But, let's roll with the assumption it's "literally a crime" and not a civil matter; but apply that standard equally.
> (4)knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;
* Is the draft novel/rubygems source code a thing of value? Yes. $5000 worth? Tricky to say with the open source licencing! But RC were distributing $ to maintain it; and that cost them more than $5000/year. Cost does not equal value; but I think we can argue yes, kinda here.
> (7)with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any—
* Did anyone attempt to extort anyone else to remove a person? (Get rid of x if you want access back!) * Did that have value? (Gee, I hope the treasurer didn't post, it was about the funding deadlines/only to have that walked back!) Also a bit murky as the value isn't coming from the extortion directly, only indirectly.
> (b)Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section.
* Did anyone conspire? (Two or more people agree to criminal act, followed by an overt act)
Can you plausibly see how if you try to apply US law to argue one individual on one side is a criminal; that same law would likely make the other side just as criminal; if not more so?
---
> none of the ones complaining were the original authors of gem nor bundler.
Doesn't hold water.
From the individual: https://andre.arko.net/2025/09/25/bundler-belongs-to-the-rub...
"I joined the team at a pivotal moment, in February 2010, as the 0.9 prototype was starting to be re-written yet another time into the shape that would finally be released as 1.0. By the time Carl, Yehuda, and I released version 1.0 together in August 2010, we had fully established the structure and commands that Bundler 2.7.2 still uses today."
IE: Claims to be a significant contributor, predating any "stewardship" by RubyCentral. I would argue this can be born out by contributions and the fact he proposed the darned merger with RC in the first place; and that merger assigns no intellectual property rights or similar.
I think we have to wait and see how much momentum gem.coop can build. Right now they have promised "things for the future"; they will most likely also deliver eventually. But right now they are not there.
If and when they open beta, though, I'll begin to republish my old gems (not all, some I merged into other gems but most of the core stuff will be back) there. They have some things they should improve on though - documentation (also a problem that ruby doc was separate by the way), namespacing (this is in part also a problem that ruby had no primary way of namespacing; this is also a feature, but it should have a way to separate concerns when possible or wanted).
Anyway, I think we'll soon see what happens - I say people should evaluate again in about half a year or so, say like ... end of May 2026. I think this would be a more realistic time frame.
I do, however had, also suspect that DHH may become the biggest asset to gem.coop - every further snide remark he does on his blog, will gain new people who are upset, and some of those will eventually help contribute and benefit gem.coop. So for the end user this may be a win-win situation since they can install things how they like it, thus having more flexibility. Many can and will stay with rubygems.org, others may prefer gem.coop, many others will probably use and combine both (this may be a bit more difficult; guess gem.coop needs to think of a way to specify different gem sources on a per-gem basis too. Lots of work to be had for certain).
No serious business with real (business) customers will accept that kind of risk and gem.coop will never be a thing outside of hobbyists.
He logged in and changed the password after the board emailed him and told him his services were terminated. That includes/specifically mentions his on-call services. His response claims only silence from the board and that he was just performing his on-call duties.
I've been a corporate stooge for 25 years or so now. On call duties are one of my main responsibilities. I would NEVER probe out which logins I still have access to after receiving notice of termination. He admits to doing this in multiple places.
All his justifications are that he was under contract to do work that he was already notified was terminated. Everything that follows either tells me that he has bad judgment, that he's lying (by omissions), or in the worst case totally delusional.
If he was so worried about operational takeover, why did he _change a password_ without notifying anyone else with operational capabilities that he was doing so? Nobody reasonable would _ever_ do that. There's a certain amount of upfront communication and CYA required of reasonable actors in this space and he doesn't have it (Not that Ruby Central did any better).
So no, I won't be changing my mind, and I don't know why you put "(again)" in there.
Regardless of what Ruby Central did, his own actions warrant every bit of criticism he's getting. Stop trying to redirect the narrative. There are other threads where that discussion is happening.
You can view Ruby Central as being in the wrong all you want and I won't argue with you, but that doesn't mean Arko is not-wrong as well. It's not zero-sum.
I don't understand how Matz accepted this as-is. Taking over these projects without addressing the takeover makes them toxic assets that will taint the Ruby community for a long, long time.
What you're doing is called a Whataboutism. I was responding to a comment about gem.coop.
Andre Arko is not credible and thus gem.coop is not credible. He can explain all he wants but his actions were plainly inexcusable. Whatever Ruby Central did is immaterial to the point of whether or not Andre Arko can be involved with services that we rely on.
All in all, I don't see sound judgement from Andre Arko or from RubyCentral. That seems the common takeaway from neutral third parties https://archive.md/SEzoV
> Regarding Arko’s blog post about his removal, McQuaid [Homebrew Maintainer] told me it’s good that Arko is crediting other people for their contribution and that he’s following open source principles of community and transparency, but that “his ‘transparency’ here has been selective to things that benefit him/his narrative, he seems unwilling or unable to admit that he failed as a leader in being unwilling or unable to introduce a formal governance process long before this all went down or appoint a meaningful successor and step down amicably.”
It tripples the attack surface making it more vulernable to having security vulnerabilities.