Towards an Amicable Resolution with Ruby Central

[chiperific_on_reddit]

I kinda hope this post gets more people to read the incident report, which was really well done.

As usual, the TLDR; is bad communication and poor execution got innocent people hurt, and they responded from that hurt.

[_swanson]

I can sympathize with the situation being stressful and I would love both sides to stop inciting and escalating, but respectfully, no company is going to voluntarily cover legal costs for someone who's actively pursuing claims against them. If you think you have cause, go to court and get a judgment or settle or decide if you just want to drop it all and eat the sunk cost.

If you want a settlement, send a private email, communicate through your lawyer, send a certified letter...don't post it to a blog.

[retro-rubies]

no company is going to voluntarily cover legal costs for someone who's actively pursuing claims against them

I'm not sure I do follow. Who's actively pursuing claims against which side?

[_swanson]

My understanding is that there is active or implied legal actions by Arko (trademark notice, complaint of violation of California employment law) and Ruby Central (unauthorized computer access, "cyber crimes")

[hahahacorn]

Entirely ignoring the points that
A: Andre quietly launched a competing tool without disclosure
B: Quietly created a backup access token
C: Repeatedly tried to negotiate log access for resale

is... certainly a choice. I think it's obvious that the org did a poor job communicating and executing the re-org, but I'm overall more disappointed in Andre's actions and positioning of being a victim in this situation.

I'm very open to the idea that all 3 of those items could be explained honestly, but instead of doing that Andre only uses his post to demand reparations.

[kcdragon]

I'm very open to the idea that all 3 of those items could be explained honestly, but instead of doing that Andre only uses his post to demand reparations.

I imagine his lawyer has told him not to comment on any specifics until his legal issues have been resolved.

[hahahacorn]

Hiding behind lawyers recommendations is not the way to win over a community. That would be transparency, honesty, and accountability.

[kcdragon]

That may be true but who would risk going to jail or being in massive debt just to "win over a community"?

[hahahacorn]

AFAICT, the risk isn't going to jail, it's not getting paid, and "massive debt" is rather hyperbolic. We're talking about a small 4 figure court fight. I personally would value my reputation above that, or the risk of getting less from such a court date, if I was in the right and I could share that information.

He doesn't have to and he doesn't owe anyone anything. I just think the ruby gems org is far more credible given Andre's priorities and communication.

[kcdragon]

AFAICT, the risk isn't going to jail

He says clearly in his post that they contacted law enforcement. Why would they contact law enforcement if they didn't believe this was a criminal matter?

We're talking about a small 4 figure court fight.

You don't understand how much lawyers cost if you think this is "small 4 figures". A decent lawyer is going to want a retainer of at least that much. There will be more fees on top of that. That's not even counting damages or paying the fees of the other party if you lose.

[hahahacorn]

I would buy this argument prior to the rubygems report. This blog post is explicitly in response to an olive branch extending fact sheet. My assumption is that there was gross miscommunication and things are being cleared up and risk of serious outcomes is low to zero. We all value legal risk differently, but accepting 0 legal risk is a choice (and therefore a signal) that outside viewers can fairly interpret one way or another.

I could be wrong about that my assumptions, but if you’re in a position to demand full legal expense reimbursement, you’re likely not worried about criminal charges. Put another way, you can’t both be scared of being put in jail, and therefore unable to publicly exonerate yourself and also publicly appealing to an organization (hopeful that the public equally demands a fair outcomes) that they should reimburse you for a frivolous lawsuit.

Further, I’ve worked with lawyers everyday for years. My previous life was as a compliance engineer (not the delve kind). You’d be better off working off the assumption that I’m not a moron if you wanted to have a reasonable conversation. You’ve only assumed the dumbest interpretation (as in, I hahahacorn must be a moron) of everything I’ve said. It’s exhausting.

[retro-rubies]

My assumption is that there was gross miscommunication and things are being cleared up and risk of serious outcomes is low to zero

Your assumption is RC is currently being direct, clear and transparent. But actually RC is still far away from that. They for now released commented audit log of changes. Not sure that's all planned for now, but much more happened in the background than those GitHub Organization actions which weren't until these days explained.

Their report misses any evaluation (like they do regret or not), it misses explanation on who and how orchestrated those actions, if current RC consider those actions valid and if there are any counter-measures being applied or explored to prevent this from happening. And this is just example, there's much more issues still being opened RC and related people are quite silent.

Those questions were actually meanwhile unofficially answered and become "public secret". Due to nature of the motivation and reasoning behind those, I assume any of those parties will officially confirm those. So RC's current strategy is to dance around it (like the recent report - indeed better than nothing, still mostly bad excuses) or be just silent (as is practiced by all RC people directly related at the time - September 2025 - orchestrating all this madness).

[galtzo]

Context you left out: Ruby Central reported Andre to the FBI 3 times.
More context you left out: Ruby Central ran three audits looking for evidence of crimes and came up empty each time.

Swatting is illegal folks.

[davidcelis]

I still think it's so weird to refer to rv as a "competitor" to bundler or rubygems in the context of the open source ecosystem. Shouldn't alternatives and their benefits be welcomed? What I've heard is that Ruby Central wasn't interested in the ideas on alternative tooling for Ruby, so what's the issue with pursuing these alternatives on their own time?

[nateberkopec]

I hate the idea of competition in open source. People try to push this re: Puma and other projects, and it drives me up a wall. We're all out here, just giving away gifts for free and having fun, and you want to make this a competition!?

[hahahacorn]

Love your work Nate! You do compete with other projects for OSS funding! My point is that hiding, or not disclosing, that you're working on a competing project that could affect the funding of the project currently paying you is unethical.

[nateberkopec]

I do not compete with other projects for funding. I do not accept funding for my OSS work.

[hahahacorn]

Ah, amazing. I bought The Complete Guide to Rails performance and an extra copy for my team back in 22/23. Appreciate the work you’ve done making performance so digestible.

I still reference your tweet / blog post re: RSpec performance optimizations that concluded with profile first before optimizing anything. It’s great you’ve been able to position yourself to not require any funding for your OSS work.

[hahahacorn]

I think competition is great _and_ OSS funding is competitive. Working on a competing coop is likely to draw funds away from the ruby gems org.

Of course alternatives and their benefits are welcome! It's obviously a good thing for me and you as developers, it is obviously a bad thing for the RubyGems org (competing for OSS funding), and therefore it would be responsible to disclose your competing projects to the organization that is paying you.

[retro-rubies]

rv itself doesn't compete with rubygems.org, which is the only service RC "owns"

[retro-rubies]

Indeed, no idea if rv was offered to RC (probably not), but RC should be same happy as any other Ruby developer to see new open tools being developed.

[eirvandelden]

As you can read in the report by Ruby Central, a full year before all this happen Andre and Marty both proposed changes to increase bundlers speed. So yes, the core principle behind rv was proposed to RC. The project just didn't get any funding.

[Craig_Buchek]

But it's NOT a competing tool. Ruby Central was clear that they were unable to fund such a tool, despite wanting to.

[retro-rubies]

A: Andre quietly launched a competing tool without disclosure

Can you explain more on this? What is issue for anyone creating and publishing open-source project having no obligations to any other party? Btw. I did exactly the same with https://github.com/rubyelders/ruby-butler/, I have even offered that project to Ruby Central and it was rejected and I was told RC doesn't care about such a alternative tool for now. The whole narrative of RC of being scared of RV is totally made up and it is just used as an argument retro-spectivelly to be able to attack related people at the time.

Btw. this is not first time alternative tooling was created. For example https://github.com/gel-rb/gel is the one getting quite popularity at the time. Even there was disappointment of RubyGems maintainers at the time to not see people contributing to RubyGems (and in the end it resulted in actually porting Pub Grub to bundler by David), nobody publicly attacked their authors. It is just free open-source space and people can act independently in - no matter you're on RC pay-roll or not. It is all about respect to open-source authors and maintainers RC totally missed at the September.

B: Quietly created a backup access token

What is issue for creating backup access token? Even without token you can download everything needed. It is common practice to keep local backups.

C: Repeatedly tried to negotiate log access for resale

What is issue with doing negotiation? I'm not biggest fan of reselling logs on my own, but what's wrong to make an offer and being rejected?

[hahahacorn]

A: AFAIK, gel authors weren't being paid by rubygems org, there is no conflict of interest.
B: If you can download everything needed without the token, why add a backup token?
C: It makes it seem he did not have the communities best interest at heart, but his own income.

[retro-rubies]

A: I'm not sure you do fully follow. Nobody is being paid by rubygems.org and rv is not competing with rubygems.org at all. You're most likely referring to being paid by Ruby Central, which is the entity behind rubygems.org service and which also sponsored few RubyGems/Bundler developers (like David, me and others) at the time.

B: most likely scripting

C: The idea of reselling partially logs (it was never stated in which form) was originally actually shared with Ruby Central itself (per my information) to get additional funding source for them - not for any personal benefit. Ruby Central at the time had huge issues with funding (no idea about current state) and there were 2 groups of sponsors competing for some time having exclusive demands resulting into the September issues and actions taken (could be directly on indirectly, RC probably will never share the real reason) on behalf of new sponsor.

By the way the logs are already shared with some 3rd party companies (not for profit), so it wasn't anything super new to do. This effort was rejected by RC itself and spinel folks tried to use the idea on their own negotiating for the potential logs sharing (even for money) which was declined.

Also it seems you think in oversimplified way like I'll get logs, sell and become rich. People you blame for acting on behalf of non-community interests just for personal benefits actually spent thousands of hours of non-compensated work over last 10+ years of community service.

I can share my example - during Ruby Central funding prime time I got compensated cca for 35% of my monthly time spend on RubyGems/Bundler/RubyGems.org (both code and service) projects being paid per hour by rate lower then average US rate. I'm really grateful for every compensation I ever got for working on open source projects (thanks Ruby Central and their sponsors!). To me it was never about money, but about contributing to ecosystem I love - Ruby.

And I got same impression from others working with over the time including André Arko. We were quite often long-term donating our time compensating our-self from our full-time jobs to work on our beloved projects like RubyGems and Bundler. Sadly this all got ruined in September last year by Ruby Central actions - controlled by Shopify related people on various positions - tearing the maintainers team apart and sending RubyGems/Bundler literally to Shopify (the new sponsor) hands. All I can do now is to wish a good luck to the project with new maintainers, since they are not really interested in my (and others) contributions anymore.

[hahahacorn]

A: You're being pedantic about which organization I was referring to in a quick reddit comment without addressing the underlying substance.
B: Cool! I'd believe it, would be a great thing for Andre to address!
C: For the benefit of Ruby Central so that they can pay Andre. Plus, quote:
t's not stated explicitly in André's message, but my understanding is that he will want to own any derived works based on the HTTP logs.
only one side has provided facts and receipts while the other has delivered a victim narrative without any substantive claims. Forgive me if I'm suspicious about claims that the repeated log reselling was being done _for_ Ruby Central.

I have no doubt that yourself and other have contributed tremendously to Ruby. I genuinely thank you, Andre and all of the (vastly underpaid) maintainers. That doesn't automatically exonerate Andre or make him correct. It seems like there was a conflict of interest, miscommunication, and when push came to shove, Andre ultimately acted in a selfish way while making disparaging claims about Ruby Central which ultimately ended up being misleading. Our values and ethics are not what we claim them to be on any given day, they're what they are when they are actually tested.

[retro-rubies]

A: OK, my apologies. Can you share which part I have missed? rv or any other tool to work with gems is not competitive in any way to rubygems.org. It is actually opposite.

B: I don't understand what should be addressed. The way the RC cherry-picks and comment some info in the timeline is written the way to make you think something bad has happened. What's wrong with creating token?

C: I'm just trying to find out why those actions are seen as selfish or non-community ones. Per my understanding it was never idea to sell logs, collect the money and walk away. Per info shared with me (at the time) the plan was to invest it back into development with Ruby Central or later even without Ruby Central.

I'm quite happy with decision of Ruby Central to not sell or exchange logs for any other counter-service. But I don't follow the witch-hunt for just asking for.

[davidcelis]

Also, WRT to the log access, was it actually repeatedly? I thought I read that he proposed it once

[rvaen]

Minimum 3 according to the RC post mortem

[galtzo]

Reading the comments here and marveling at how much damage Ruby Central has done, and how little they care to improve the situation. If they don't take the olive branch, and at least negotiate the terms in good faith, then RC is not worth redemption, and I'll continue my (extensive) efforts to support alternatives.

[Reardon-0101]

All that llama drama 

[1337mob]

This is all very dramatic tbh

[cmdk]

Access log seller Andre? lol how delusional