On RubyCentral and Rubygems

21 Sep 2025
Are you eager to elevate your security skills and safeguard your applications against cyber threats? I created a Rails Security course is designed specifically for developers like you who aim to build robust, secure Rails applications!
Buy my course: Security for Rails Developers.

I finally had a little time to look more into the Rubygems drama. I don’t know anything else than what you can publicly read and it looks like that information is also hard to trust.

Ellen Dash wrote his piece about being removed from Rubygems and at first read it sounded like there was no notification from RubyCentral, but actually she says “explanation”, and a later, in a reddit comment she says she was on a call with Marty when being removed, so my assumption is, this was the typical firing when they call you to say you were made redundant and they revoke access during the call, so if someone gets disgruntled, they can cause any damage. Not that I like this, but this is a standard and makes sense from a security perspective. So because of this, I am not sure I trust completely what Ellen says, she seemed to chose wording initially to make things sound worse than they were. It might not have been intentional though, but still, I take everything coming from her with a grain of salt. Someone also started to spread rumors about DHH being behind all of this and giving funding to RubyCentral with the condition of removing everyone from the team and fill it with people he likes. This turned out to be false, according to the treasurer of RubyCentral.

Now onto RubyCentral. I think they communicated this to the public pretty badly. First of all, as usual, they didn’t think about us in Europe. We saw Ellen’s side of the story while they were dreaming about metaprogramming on the other side of the pond, and many of us were even together at EuRuKo(I loved the respecful discussions about this, even with folks I usually don’t agree with online), so the news spread like wildfire, speculations started and it all snowballed from there by the time our american friends woke up and decided to release a public announcement. An announcement that was probably written by AI and didn’t do a good job at assuring us all is good. They could’ve done much, much better and I hope they learn from this fiasco.

We probably still don’t know everything that happened behind the scenes, but from what we know, I wouldn’t worry much(it would be cool though to have Rubygems mirrors to have more redundancy even just for the gems published on the official site).
What RubyCentral did, makes sense. Even though Bundler and Rubygems is opensource, most of the work on it in the past was paid (even higher than market fees, we had some drama about that about a decade ago if I recall it correctly) and I think nobody should have the right to cut new bundler releases or deploy changes to Rubygems that is not contracted by Rubygems and by signing the contract promises legal responsibility for actions. Anyone is free to contribute still though. Now having said that, I think the execution wasn’t great, but likely it wasn’t in bad faith.

One lesson for myself is to not jump on the news and chill until we hear more sides to a story. And research things better, but during conferencing that would’ve been taking away from the lovely folks I was with.

Anyhow, I am sure we will be fine and maybe this restructuring will actually make things better in the long term.

Or follow me on Twitter

Related posts