My primary takeaway from all of this is that I do not want to be depending on infrastructure run by Ruby Central. Maybe it’ll turn out that the previous status quo was even worse and we just got incredibly lucky that it never exploded, but the people now running things have consistently failed to inspire confidence.

> That said, I really don't like the hand waving of the HTTP log thing in this post

What "hand waving"? André explicitly mentioned he did not have any log or information.

They were all spitballing ideas about how to recover from the DHH-driven dropping of corporate sponsorship dollars, and how too keep the support lights on.

I think an offer of covering all the 2nd level support costs in return for the right - that Ruby Central's own T&Cs grant - to monetise company usage stats, is a reasonable offer.

The "other side's" alternative was to steal ownership and control of a whole bunch of volunteer gem authors work at the behest of a different corporate sponsor who was clearly demonstrating they wanted to be able to not only throw their weight around and force policies and priorities on RubyGems/RubyCentral, but also to make it personal by explicitly calling for long term contributors to be removed entirely on a whim.

Mh, one of our security admins recently said something that's very fitting to the discussion: If you are removing an employee from a company, and you have to rely on their personal integrity instead of technical controls to avoid problems, you are doing very basic access control wrong. And if you're doing absolute fundamentals like that wrong, how much is your entire information security worth then?

And reading this, and the other disclosure from Ruby Central, they seem to be handling this maintainer/employee offboarding woefully incompetently at really, really basic levels. Obtaining control to secret management and doing a general secret rotation of management secrets isn't an obscure first step.

To me it looks like he wasn't sure who was trustworthy at the time.

"The erratic and contradictory communication supplied by Marty Haught, and the complete silence from Shan and the board, made it impossible to tell exactly who had been authorized to take what actions. As this situation occurred, I was the primary on-call. My contractual, paid responsibility to Ruby Central was to defend the RubyGems.org service against potential threats. "

and

"Given Marty’s claims, the sudden permission deletions made no sense. Worried about the possibility of hacked accounts or some sort of social engineering, I took action as the primary on-call engineer to lock down the AWS account and prevent any actions by possible attackers."

and

"Within a couple of days, Ruby Central made an (unsigned) public statement, and various board members agreed to talk directly to maintainers. At that point, I realized that what I thought might have been a malicious takeover was both legitimate and deliberate, and Marty would never “fix the permissions structure”, or “follow up more” as he said. Once I understood the situation, I backed off to let Ruby Central take care of their “security audit”. I left all accounts in a state where they could recover access."

> According to RC's timeline, the password reset happened on September 19, but Arko did not disclose the issue to RC until September 30.

The password reset happened on September 19, and "within a few days" he realised it was an intentional/malicious takeover, and he walked away knowing they had the means to recover their own access - no longer his monkeys, no longer his circus. The 30 Sep date was when he was asked by someone if he still had access, and he discovered he did, and let them know immediately.

That all seems way more likely to be true and feels more plausible than anything Ruby Central has published over the last month or so...

He does explain it in his blog post. He changed it after the erratic communication and actions of RC leadership, then after realising what they were really doing, left them to complete their “security audit”, assuming they’d discover it themselves and take appropriate action as part of that. That never happened (which is wild), so he let them know.

They still don’t seem to be in complete control or understanding of the infrastructure they forcefully took control of.

So weird that Marty is using corporate speak to someone who I presume he's been working with for up to ten years.

All of them really, not just Marty H.

Yeah, given that RC was willing to publish an email from Arko about an unrelated topic in their “security incident review”, it’s unfortunate they aren’t publishing how the access suspension was actually communicated to folks. Sounds like it was sudden enough and weird enough that Arko’s actions in response of locking down the AWS account were totally justified.

DHH is political activist, hardcore radical one. Always was. It is completely absurd how radical right wing gets labeled "apolitical" in these takes.

Cheerleading the fascist "Tommy Robinson" is not apolitical

Politics is unavoidable when groups of people get together, as politics is defined as how groups make decisions [1].

Therefore, "open source software should be a-political and open to all" is by definition both impossible (you cannot have a group without politics) and a political statement (as it is suggesting a decision making process.) Furthermore, don't mistake a conservative position (e.g. everything should stay the same) for an apolitical one.

[1]: For example:

> politics: “who gets what, where, when, and how”—the process for resolving disputes and allocating scarce resources"

https://openstax.org/books/introduction-political-science/pa...