Post
“On the client tools side, while the repos could have been forked, as long as individuals could publish the gems from any source they want, no forked repository could have been the canonical and secure source of the tools.”
I have no idea what this word salad means. I really have no idea.
And this goes for a lot of the technical details. I don't understand what they're saying. Either I'm very stupid (it's possible), or they continue to obfuscate.
@jaredwhite my email client refused to render the entire contents because it was too long.
This AI generated banal collection of mistruths has no value, they should’ve just sent nothing.
“Discussions about transferring the RubyGems and Bundler repositories under the Ruby Core team have been ongoing for several years.”
Oh really? This is the first I've heard of it. And believe me, I read just about every hot take and loose thread of debate in the past month across multiple Discords and social media. Nobody mentioned “the likely outcome here based on past conversations is Matz steps in and Ruby Core takes over”. That announcement felt out of the blue.
@jaredwhite if this was the case wouldn't people have heard about it sometime in that multi year process? Even if it was just a rumor
@McNeely I've heard lots of people spitballing that in a perfect world we'd have some kind of "Ruby Foundation" which would oversee Ruby core, the package manager, and other aspects of common Ruby infrastructure. But just thinking it's an interesting idea doesn't mean it was bound to happen, or even *could* happen.
@jaredwhite there's a big difference between looking at Python, Rust and other languages and saying "hey why don't we do something like that" and actually making concrete plans to DO something like that.
“The Board acted independently in their decision based on the internal timeline that was set; there was no sponsor-imposed funding deadline. Ruby Central maintains standard sponsorship agreements that do not grant operational control…sponsors were only briefed as part of normal communication and were not involved in any decisions or deadlines. ”
I don't believe this. I simply flat-out don't believe this. It flies in the face of all outside reporting to date.
@jaredwhite Including from a sitting board member. 🙃
“On the client tools side, while the repos could have been forked, as long as individuals could publish the gems from any source they want, no forked repository could have been the canonical and secure source of the tools.”
I have no idea what this word salad means. I really have no idea.
And this goes for a lot of the technical details. I don't understand what they're saying. Either I'm very stupid (it's possible), or they continue to obfuscate.
@jaredwhite I'll attempt a translation: While the clients could have been forked, we don't want you to trust the developers that you've trusted so far (by running their code on your machines) any longer. Instead, trust us. We're not telling you why.
Also, we could have switched to a fork of bundler on our systems, but we couldn't be bothered to make that change and it's a lot of effort, so we just stole the upstream instead.
@jaredwhite It makes perfect sense to me, but only because I've dealt with people in leadership roles who've said similar things. It's at best an inaccurate understanding, at worst a lie.
Either way, it's false. Because even if you take it at face value, it completely misconstrues the relationship between the GitHub repo, the deployment of code to rubygems.org, and the content managed by rubygems.org.
And here's perhaps the weirdest thing about this Q&A update…it feels completely disconnected from the transfer of the repos to Ruby Core's ownership. Like, maybe you’d take out a couple of sentences, and if that transfer had never happened, this document could remain identical.
My guess? A lot of this was written before that transfer even happened. So that's why almost nothing here addresses the transfer. How does Ruby Core fit into the past month's events? Beats me!
It's really pretty clear to me at this point that there's no point in expecting current Ruby Central leadership to address the harms to date. At every turn they could have done something meaningful to get the train back on the track, and instead they engaged in more corporate-speak word salad that sounds like what non-technical people say whey they're trying to convert an email some hapless programmer sent them into legalese for a C-suite.
Time for new leadership.
A space for Bonfire maintainers and contributors to communicate
