A Board Member's Perspective of the Rubygems Controversy

People went WAY too far WAY too fast on this. There HAS to be urgency to this, the software supply chain is presently, undeniably, under attack.

Frankly, everyone blasting RubyCentral the last few days should feel shame and embarrassment. These aren’t evil suits at Microsoft, they’re normal people invested in maintaining a critical piece of infrastructure for the good of all who love and profit from Ruby.

is somewhat at odds with

> Some [...] companies specifically pay Ruby Central to ensure the security and stability of that part of the supply chain,

but not so much. Then the sentence goes on with

> but then discovered that people with no active affiliation or agreement in place had top level privileges to some of this critical infrastructure.

So something has been wrongly managed or wrongly sold.

Then the final part about the emotional conversations and the dilemma sounds honest or at least very plausible, but as they write, the critical mistake already happened.

I don't know how to reconcile 'they love Ruby and our community' with moves that are actively hostile to the community.

Something like:

"Hey all, RC here: with the very real threat of supply-chain attacks looming around us, one of the critical financial backers of our nonprofit org gave us a deadline around tightening access to the Github Account for rubygems/bundler. We tried and failed to arrive at a consensus with the open-source volunteers and maintainers for the best path forward and were forced to make a decision between losing the funding and taking decisive (if ham-fisted) action to keep Ruby Central financially healthy. We think RC's continued work is important enough that we stand by our decision, upsetting though it might be, but want to work out a better one ASAP. We are genuinely sorry for any fear/disruption this has caused."

Something simple that just owns the fact that they screwed up and tried to handle it as best they could. Doing this proactively as soon as they made the changes and broadcasting it would have been even better, but even posting this in reply to the controversy would have done more imo...

"I WANT to apologize ... that I feel awful."

"How can you possibly talk to someone about changing access, when multiple people tell you no, you are wrong?! A coup is the only way!"

"Because funding deadline, we executed a coup, which will keep everyone safe from hostile actors... Taking over accounts and access"

https://pup-e.com/goodbye-rubygems.pdf

> On September 9th, with no warning or communication, a RubyGems maintainer unilaterally:

> renamed the “RubyGems” GitHub enterprise to “Ruby Central”,

> added non-maintainer Marty Haught of Ruby Central, and

> removed every other maintainer of the RubyGems project.

> On September 18th, with no explanation, Marty Haught revoked GitHub organization membership for all admins on the RubyGems, Bundler, and RubyGems.org maintainer teams

Which is important context that was left out of this board member's statement.

I am skeptical that the model where people carry out defined tasks in exchange for getting paid can properly discharge the obligations of trustworthiness and disinterest that are necessary for the proper functioning of software supply chains. I'm thinking that probably people whose motivation is primarily personal gain will seek out ways to exploit their users' trust for additional personal gain, for example by bundling adware and other malware into their software the way Microsoft does with Windows, or only releasing security updates to paying customers.

Open-source licensing provides some protection against this problem, because it guarantees you the legal right to switch to a non-malicious fork; but the whole reason we're talking about open-source supply chain security in the first place is that your vulnerability to your chosen upstream is still far from nonzero.

This is basically like fixing technical debt. It's painful and it's political but sometimes you have to do the right thing for the community as opposed to trying to assuage individuals' egos.

This makes a lot of sense, and it puts the 'drastic' action in understandable light.

It also contrasts with the 'On September 9th, with no warning or communication, a RubyGems maintainer unilaterally...' from the Goodbye RubyGems letter. Perhaps that person did not have communications or insight?

Going forward I think we could judge the good faith, if it's uncertain, by if we do see people reinstated. Cutting off access (for urgency with a deadline) followed by reinstatement (because they contribute) would match this post. No doubt there will be hurt feelings on all sides, which is understandable, but I hope as humans everyone can get through it.

But I don't see any excuse for not putting out a statement when you do it. You have to know there will be a fight, and you will look like the bad guy. Perhaps I could see directly communicating to the maintainers that you expect that they'll be reinstated. But to say nothing? To let the post by duckinator float around for days without having a "we did this because of security concerns, we want to work together and find a resolution..." It's incomprehensible that they thought this would go well.

How much information and what information did Board members have when making their votes?

One thing that hasn’t been addressed is who was responsible for communications and implementation of this. It says here that the Director of Open Source did what the Board asked of him. Outside of the Board, which as stated here were heads down and trying to problem solve, Ruby Central’s website also shows a staff of several non-technical employees. Prominently, there is an Executive Director with a background in communications and non profit work per their LinkedIn. Where was this Executive Director and the other staff members during this? Were they involved with decision making and communication around this? How involved was the Board of Directors in implementation after the decision was made? It is a hollow statement to say they are just technical people trying to problem solve when there appears to be a whole team of non-technical staff members and an executive specializing in communications. Something clearly went wrong here and there are a lot of missing pieces around what happened after the vote took place. Most of this could have been mitigated with standard processes and simply communicating to maintainers and the community.

The actions taken by people in service of Ruby Central have had unintended consequences, including damaging the community's trust in Ruby Central's stewardship.

A new governance model will solve only the problem of there not being a governance model. There also has to be an acknowledgment that the lack of an existing appropriate governance model wasn't just a "fiduciary failure," but a failure which cased harm to the community and contributors. Contributors who—like the board—are volunteers, and would have probably liked to have their significant dedication shown more respect.

You show respect to someone by giving them important information from which they can use to make their own decisions. As opposed to withholding information because you are uncomfortable with the possibility that they may make a decision you don't want them to.

In particular, after a long winded introduction and setting of the scene, suddenly there’s a mention out of the blue of a 24 hour deadline to cut off access or face losing funding (forever)? But who was holding this deadline over the board’s head is not explained (in fact the author doesn’t seem to know???).

Overall this just reinforces the impression that the RC board handled this sloppily and in a rushed manner, and failed to communicate with long term community members, and thought of themselves as the only parties who mattered, while not taking responsibility for holding such an important position (see the opening paragraphs about how “we don’t have time to communicate to the public because we’re busy programmers without a PR team”).

> Some of those companies specifically pay Ruby Central to ensure the security and stability of that part of the supply chain, but then discovered that people with no active affiliation or agreement in place had top level privileges to some of this critical infrastructure.

This is the most candid bit of the article.

RubyCentral seems to have screwed up. The sense I get after reading this paragraph is that RC's non-apologies about poor communication are smoke. Why did they have to move this quickly/silently? Well...

If you are taking money from businesses in exchange for certain assurances about the security/soundness of RubyGems, you have a responsibility the minute pen leaves paper to KYC(ontributors). Not when there's suddenly a fire, or when your clients notice.

By all appearances, RC was negligent, if not necessarily in the legal sense. They were highly reactive in response to a problem they should have been across already, and they have paid for it with a chunk of the Ruby community's trust.

To now retcon this action as poorly-communicated but ultimately noble and security-minded does not sit very well.

Seems pretty clear after reading this. If 1-2 companies pulling funding is enough for them to force you to to what they want, its hard to stay independent.

https://bsky.app/profile/mikemcquaid.com/post/3lz7klsyue22f

https://bsky.app/profile/mikemcquaid.com/post/3lzfxctubbk2y

TL;DR: Regardless of what you think of RubyCentral’s actions, it’s very clear they absolutely screwed up the execution and communication here. In general the transparency is far below what you’d expect from an open source organisation.

> I want to apologize, genuinely, to people who have felt (...) outrage (...) after reading some of what others have shared.

He's apologizing for what others have shared, not for what they (Ruby Central) did.

> I often go out of my way to avoid making people feel bad

"I'm the good guy."

> and so to be part of what's caused so much chaos lately has really been awful.

"_I_ feel awful."

"I'm sorry for what others have said about what we _did_. I feel awful for people being outraged" Amazing.

> this is a small group of volunteers spread out all over the globe. (...) It's just us.

You didn't, for a single moment, think about notifying the people involved that you are removing them? It's the very first thing to do - notify someone who's involved of the change in their status. If your communication skills didn't reach a level in which you thought that would be the thing to do, I don't know what to tell you.

> It is really boring stuff. So why do I do it?

So what? Should we feel sorry for you?

> I love the community. I love the people who use Ruby, (...) I love the people who give their time to Ruby and I love the people and companies who generously provide financial support for Ruby.

Cool.

> I can't speak for the board or the Ruby Central staff. But (...)

proceeds to speak for the board and the Ruby Central staff.

> Ruby Central has been responsible for RubyGems and Bundler for a long time.

This is a lie. RubyGems and Bundler have been maintained by a group of core maintainers. Some members of this group were also Ruby Central staff, but not all.

> It's not a new story that Ruby Central has been working on (or trying to at least) improve the governance model for Bundler and RubyGems.

It's a new story to me. If it's not a new story, do you mind sharing some links to past discussions?

> How do you tell someone that has had commit and admin access to critical infrastructure long after that need has expired that you need to revoke that access without upsetting them?

You learn some basic English. And then let them know. It's called communication.

> And what if other people who do still need that access claim things like "If you remove their access, I'll just add it back" or "If you remove their access, I'll quit".

It's called consensus. And communication. You talk. You speak with people. And then you agree on a decision.

> These are emotional conversations.

Yes, they are. Is that why we shouldn't have them? When you want to leave your wife, do you just leave? What a strong person with strong values.

> I wasn't a part of them and can't actually speak to the content of the conversations or how they were handled.

Bad. They were handled bad. Why did you write this post? You don't have information, you don't know what happened...you just love people and community and companies. Happy happy joy joy.

> we don't have a "communications team"

You don't need a communications team. You just need to have a communication channel public or private, where you can reach all of the core members. It could be an email with everyone in CC.

> A deadline (which as far as I understand, we agreed to) loomed.

If you're not sure whether it was agreed on, again, communication. Learn how to communicate. Which deadline? Who set this deadline?

> With less than 24 hours to go

Did someone give you 24 hours deadline? Why wasn't this discussed long before the deadline?

> Marty, Ruby Central's Director of Open Source

How the f is Marty? If he wasn't one of RubyGems maintainers, why is he suddenly being put as the main maintainer? Aside from communication issues, you also have decision making issues. All of the core members should come to an agreement, without Marty.

> I love this community and I love Ruby.

Cool.

Please find some time to read a book or two on communication skills. As well as decision making.

Read the comments in this thread. Ignore mine, don't think too much about it. Just read other comments. Then think again about your decision and to which percentage people in this thread agree with it. And perhaps reevaluate it.

> How do you tell someone that has had commit and admin access to critical infrastructure long after that need has expired that you need to revoke that access without upsetting them?

Start by letting go of the goal of not upsetting them. Make sure you do communicate clearly. Just say what you said a paragraph earlier: open source ecosystems, including ours, are increasingly suffering supply chain attacks. To guard against this, we need to tighten access that has traditionally been fairly loose. Starting <date>, we're going to remove general access and ask that contributors sign <link to agreement> before re-enabling access.

I mean, maybe that is what happened -- as the OP says, he wasn't part of the conversations so can't say. From the earlier public posts, it doesn't _sound_ like that's what happened. But I'd say as a general rule, it's important to communicate disruptive changes ahead of time to those affected and give a clear path to how they can mitigate the disruption.

Just drop all the facts. Acknowledge you fucked up. Or dont say anything at all?

A board position means responsibility not just "head down coding". And that means communicating with people.

For clarity I wasnt super keen on the original submission this is responding to, for similar reasons.

If the request for additional access controls/access cleanup came from one of the Ruby Central funders, could we not know who that was and what exactly their ask consisted of? I am interested in knowing their side of the story, and what the motivation was. (But in general, cutting off long-time maintainers' access seems like a bad choice - as presumably they have long since proven their good will toward the ruby community as shepherds of these projects.)