I'll keep this post evergreen, as the situation evolves.
👣🔍️ First some background reading 🕵️
- RubyGems (the GitHub org, not the website) suffered a hostile takeover in September 2025.
- Ultimately 4 maintainers were hard removed and a reason has been given for only 1 of those, while 2 others resigned in protest.
- It is a complicated story which is difficult to parse quickly.
- Simply put - there was active policy for adding or removing maintainers/owners of rubygems and bundler, and those policies were not followed.
- I'm adding notes like this to gems because I don't condone theft of repositories or gems from their rightful owners.
- If a similar theft happened with my repos/gems, I'd hope some would stand up for me.
- Disenfranchised former-maintainers have started gem.coop.
- Once available I will publish there exclusively; unless RubyCentral makes amends with the community.
- The "Technology for Humans: Joel Draper" podcast episode by reinteractive is the most cogent summary I'm aware of.
- See here, here and here for more info on what comes next.
- What I'm doing: A (WIP) proposal for bundler/gem scopes, and a (WIP) proposal for a federated gem server.
My thoughts
- I no longer trust Ruby Central.
- I no longer trust certain members, but primarily HSBT, of the RubyGems core team.
- I no longer trust certain members, but primarily HSBT and Matz, of the Ruby core team.
Q: In what sense do I not trust them?
A: 📃 Governance 📃
To be more specific, I no longer trust that they:
- Hold people accountable for their actions according to written agreements and documentation around governance policy.
- Understand the community upset over point 1.
- Will ever do anything about it.
If they are added to your repository, you may wake up to find you have lost access to your own project.
I'm not OK with this having already happened to others, and have taken steps to ensure it will not happen to me.
Within my open source projects, I will reduce, to the degree possible, my reliance, on any project hosted under the Ruby org on GitHub. Since most of my projects are Ruby projects, I'll never get to complete exclusion, but I will be focusing much more on JRuby and Truffleruby.
Top comments (1)
Wow I did not know all these details