Post

I have fact-checked Ruby Central’s claims here joel.drapper.me/p/ruby-centr...

This post looks like it was written by AI. Has no signature from a human willing to take responsibility.

I wonder how this all relates to rubycentral.org/news/ruby-sh... given some of the aim of the ongoing partnership

"in order to prevent supply chain attacks we took over a github org we don't actually own 🙃"

"in full transparency we went ahead and did the whole damn thing behind closed doors" ... ;-/. give me a fucking break. i am working an new, decentralized, democratic, alternative to ruby central. DM for deets ppl.

This is clearly not an appropriate or proportionate move, and you've broken a significant amount of trust with the Ruby community. You need to take immediate steps to restore longtime Rubygems and Bundler maintainers and reexamine the processes that allowed this to happen.

You can interpret my comments a few ways. I could just be stirring shit. Or I could have heard some things that nobody wants to be legally liable for saying publicly. Since I’m kinda on sabbatical while I move back to Canada I am freer than most. Your call I guess, am I a horrible rumormonger?

I appreciate all the work y'all do and the motivation to safeguard such an important piece of infrastructure is great, but the way this was handled and the resulting kerfuffle seems like it was totally avoidable.

« we are making changes to ensure these critical services are supported in a sustainable, transparent, and secure way […] following a recent security audit » Will you publish in a near future the result of your recent security audit to be transparent?

« As the nonprofit steward of this infrastructure, Ruby Central has a fiduciary duty to safeguard the supply chain and protect the long-term stability of the ecosystem. » 1. Is it a reaction to the NPM supply chain attack? 2. In front of which risks in the Ruby gem ecosystem?

« At the heart of Ruby Central’s mission is our responsibility to steward the open source tools that power the Ruby ecosystem. » « Moving forward, only engineers employed or contracted by Ruby Central will hold administrative permissions to the RubyGems.org service. » Can you explain this please?

Hmm.. pup-e.com/goodbye-ruby...