> Ruby Central’s actions during this period were taken in response to a breakdown in a working relationship with an individual who had significant access to infrastructure and code
> [...]
> At the time, we believed a serious risk had been introduced to RubyGems and related services.
> [...]
> The review was ultimately inconclusive because key logs required for a complete analysis were no longer available. We recognize that this creates continued uncertainty.
So, after all that finger wagging and posturing around how the new RC regime was right to oust the previous maintainers, it turns out none of their justifications had any basis in fact? In all honestly this has just been one rake-step after another and I can't imagine how anyone could continue to be confident in their decision making.
Perhaps gem.coop might win out just by virtue of not putting themselves in these positions unnecessarily.
Not a rubyist so just curious on the background and if this is the “good” or the “bad” side in the spat? What’s the other side and what has been the broader community impact?
From what I can tell, this story is primarily about personalities. The community essentially ended up with several factions, but I’ll try to explain this without it degenerating into the schoolyard fighting that it appears to be.
1. Ruby Central is the surviving Ruby non-profit that another Ruby non-profit, Ruby Together merged with. This is where part of the legal ambiguity/dispute comes from that will make sense in (2).
2. RubyGems (the code, GitHub repo, etc) and RubyGems.org are two separate things. RubyGems code appears to not have been legally transferred in the merger. RubyGems.org is run by Ruby Central, but this transfer is also extremely muddy.
3. For reasons in dispute, Ruby Central seized the GitHub repos of RubyGems. It is not clear they have the legal or ethical right to do this (based on the evidence, I believe they do not and they have committed theft).
4. Ruby Central has made various noises about the need to do this for security and other things despite the extremely sloppy nature of the takeover.
5. Ruby Central then “gave” RubyGems to the Ruby core team without resolving anything in what appears to be an attempt to try and end the controversy.
Read the above, but tl;dr is that Shopify executed a hostile takeover of Ruby Central for its own benefit, at the expense of long-term maintainers and the general community. I'm not sure if there's been any real change since then, but there are many reasons not to trust anything that the board says at this point.
IMHO, Ruby Central keeps trying to find a way to frame all of this in a good light, but it seems like they keep falling flat. They tried doing filtered Q&A avoiding all the obvious questions that people hostile to what happened would ask, temporarily providing transparency reports that didn’t really say much. It all felt like very incompetent damage control.
I think they were hoping that handing it off to the Ruby core team would allow them to move on, but that requires ownership of their failings or at least actions that demonstrate that they will be better moving forward and none of that has happened.
Not sure he's "on the outs", he on Shopify's board.
Sidekiq's solo dev (Mike Perham) has for many years made a generous donation to Ruby Central. He informed them that he didn't want his money to be spent platforming dhh at their conference, they ignored his request, he stopped his annual donations.
Shopify and/or its technical leadership worked its connections to oust a Rubygems maintainer they saw as a threat to Ruby projects Shopify has invested in.
This was especially provocative because it involved Ruby Central asserting control over Rubygems, which it does not own.
It was (by credible accounts) a "preemptive strike" on this maintainer, and thus was not communicated to other RG maintainers, who were understandably angry.
The statement from RC at the time sounded like lot of CYA, and this doesn't read as all that sincere either.
ruby's lack of growth has caused certain people, organizations etc to have an outsize influence for good or bad on the ecosystem.
some people have felt unwelcome altogether.
So, after all that finger wagging and posturing around how the new RC regime was right to oust the previous maintainers, it turns out none of their justifications had any basis in fact? In all honestly this has just been one rake-step after another and I can't imagine how anyone could continue to be confident in their decision making.
Perhaps gem.coop might win out just by virtue of not putting themselves in these positions unnecessarily.
1. Ruby Central is the surviving Ruby non-profit that another Ruby non-profit, Ruby Together merged with. This is where part of the legal ambiguity/dispute comes from that will make sense in (2).
2. RubyGems (the code, GitHub repo, etc) and RubyGems.org are two separate things. RubyGems code appears to not have been legally transferred in the merger. RubyGems.org is run by Ruby Central, but this transfer is also extremely muddy.
3. For reasons in dispute, Ruby Central seized the GitHub repos of RubyGems. It is not clear they have the legal or ethical right to do this (based on the evidence, I believe they do not and they have committed theft).
4. Ruby Central has made various noises about the need to do this for security and other things despite the extremely sloppy nature of the takeover.
5. Ruby Central then “gave” RubyGems to the Ruby core team without resolving anything in what appears to be an attempt to try and end the controversy.
In the background of all of this appears to be a lack of trust, dhh posting crap like this: https://world.hey.com/dhh/as-i-remember-london-e7d38e64, resulting in a fight about the future of the Ruby ecosystem.
Read the above, but tl;dr is that Shopify executed a hostile takeover of Ruby Central for its own benefit, at the expense of long-term maintainers and the general community. I'm not sure if there's been any real change since then, but there are many reasons not to trust anything that the board says at this point.
I think they were hoping that handing it off to the Ruby core team would allow them to move on, but that requires ownership of their failings or at least actions that demonstrate that they will be better moving forward and none of that has happened.
Sidekiq's solo dev (Mike Perham) has for many years made a generous donation to Ruby Central. He informed them that he didn't want his money to be spent platforming dhh at their conference, they ignored his request, he stopped his annual donations.
If you want to read about dhh's colorful blog posts and tweets: https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug...
[1] https://jakelazaroff.com/words/dhh-is-way-worse-than-i-thoug...
This was especially provocative because it involved Ruby Central asserting control over Rubygems, which it does not own.
It was (by credible accounts) a "preemptive strike" on this maintainer, and thus was not communicated to other RG maintainers, who were understandably angry.
The statement from RC at the time sounded like lot of CYA, and this doesn't read as all that sincere either.