monday morning quarterback, here's probably what should have happened:
1. ruby central says internally: we're resetting privileges for everyone to rubygems.org to zero. sign this or walk. here's our new GH org and repo for rubygems.org, which is what we're going to use to deploy to rubygems.org in the future.
2. here's our new rubygems and bundler repos. Ruby core says they're going to pull from these now. To contribute to these repos, sign this or walk. You're free to keep working on the repo you've got, but ruby core isn't going to officially pull from it for new releases any longer.
I think they lacked the explicit support from Ruby core to make this happen so it ended up being a night of the long knives type situation. They always had the moral right to do what they did re rubygems.org but not for bundler/rubygems and they chose to steamroll and this the blowback they get as a result. Ultimately I think most people realize they had to take these steps for the sake of securing the supply chain, but the execution could've been done differently.
throwing shopify under the bus here is counterproductive. Their demands were not unreasonable. This is how nonprofits work, you're fundamentally owned by your funders. Ruby Central has tried to make individual membership programs work but they failed. We ceded, as a community, that we want our community nonprofit to be funded by big corporations, so it's sour grapes now if you come around when the shit hits the fan and say "shopify's interests don't align with mine".
RubyCentral could have done this without burning 100% of their existing maintainer relationships by doing something more like what I said above. Probably some people were always gonna say no. But I think a decent number of them would've responded much better to a clearer plan done on a less crash timeline. Again ultimately I give them a lot of grace because they've been doing the work for us for a long time, even when we weren't paying attention like we are now.
1. ruby central says internally: we're resetting privileges for everyone to rubygems.org to zero. sign this or walk. here's our new GH org and repo for rubygems.org, which is what we're going to use to deploy to rubygems.org in the future.
2. here's our new rubygems and bundler repos. Ruby core says they're going to pull from these now. To contribute to these repos, sign this or walk. You're free to keep working on the repo you've got, but ruby core isn't going to officially pull from it for new releases any longer.
I think they lacked the explicit support from Ruby core to make this happen so it ended up being a night of the long knives type situation. They always had the moral right to do what they did re rubygems.org but not for bundler/rubygems and they chose to steamroll and this the blowback they get as a result. Ultimately I think most people realize they had to take these steps for the sake of securing the supply chain, but the execution could've been done differently.
throwing shopify under the bus here is counterproductive. Their demands were not unreasonable. This is how nonprofits work, you're fundamentally owned by your funders. Ruby Central has tried to make individual membership programs work but they failed. We ceded, as a community, that we want our community nonprofit to be funded by big corporations, so it's sour grapes now if you come around when the shit hits the fan and say "shopify's interests don't align with mine".
RubyCentral could have done this without burning 100% of their existing maintainer relationships by doing something more like what I said above. Probably some people were always gonna say no. But I think a decent number of them would've responded much better to a clearer plan done on a less crash timeline. Again ultimately I give them a lot of grace because they've been doing the work for us for a long time, even when we weren't paying attention like we are now.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
