Rafael França

That says more about the state of the game industry than about AI. There wasn’t any good new game for a while 🤣

[ENG] ⏰ It’s today!
 The Call for Proposals for Tropical on Rails closes today.
👉 Submit your proposal.

[PT-BR] ⏰ É hoje!
 O Call for Proposals do Tropical on Rails encerra hoje.
👉 Envie sua proposta.

cfp.tropicalonrails.com/

#TropicalOnRails #RubyOnRails #RubyCommunity #CallForProposals #CFP

Dear gem maintainers 👋

Rails 8.1 just dropped, but many gems can’t be used because of overly strict gemspec constraints.

Please don’t hard-restrict Rails versions, let us test early and report real issues sooner! ❤️

Thanks

Sorry that people are making your feel that way. I appreciate you and your presence in the community.

And there was a time were we were not doing anything significant in the community. Companies didn’t invest back there either.

It is possible but I don’t think it is that. we often engage early with other companies in different avenues trying to encourage them and even give our time to ramp them up. I personally many times pledged my own time to help other companies to do a little bit more.

Anyone with experience obtaining and addressing CVEs knows that it is shameful for an OSS programmer to disclose information about a security incident before sharing it with relevant parties and coordinating a response.

No. I think it is worse. I have seen people saying that behavior is acceptable, and proposing to a non-profit giving they data for personal financial gain is acceptable and justified in the name of monetizing volunteer work.

People just want to be right.

Ruby Central dropped the ball here on securing the root account and effectively lost control of it for 11 days - however, that's nothing compared to changing the root password. If an ex-employee did that to me I'd be calling the police.

People jumped to conclusions about this RubyGems thing For context, last week I wrote a post bringing to light a number of things Andre Arko had said and done (/posts/why-im-not-rushing-to-take-sides-in-the-rubygems-fiasco/) in the past as a way to provide some context. Context that might explain why any of the principal actors involved in the RubyGems maintainer crisis (summarized well up to that point by Emanuel Maiberg (https://www.404media.co/how-ruby-went-off-the-rails/)) would take such otherwise inexplicable actions and then fail to even attempt to explain them. Today, Jean shed some light on Shopify's significant investments in Ruby and Rails open-source (https://byroot.github.io/opensource/ruby/2025/10/09/dear-rubyists.html), and it actually paints a picture of corporate investment in open source done right. (Disclosure: I know and am friends with several people who work at Shopify on these teams, and unless they're all lying to me, they sure seem to prioritize their work based on what Ruby and Rails need, as opposed to what Shopify wants.) Jean went a step further by contrasting Shopify's approach with the perverse incentives at play when individuals or groups receive sponsorships to do open source. He also drew a pretty clear line of those incentives playing out based on how RubyGems and Bundler maintainers reacted to Shopify's feature submissions. Read the post, it's good.

People jumped to conclusions about this RubyGems thing

Rubygems.org AWS Root Access Event – September 2025 As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what…

Here’s a note from our Executive Director regarding our recent security incident.
rubycentral.org/news/rubygem...

Thank you for writing this, especially:

> Aaron got nerd sniped into making Bundler faster, and now he’s being called out for supposedly being part of a hostile takeover? Give me a break.

This is by far the most sensible take ever since all this mess started.

Glad there are still some people capable making the difference between unsubstantiated conspiracy theories and proper reporting of facts.

Thank you ❤️

I really hope so.

Please share those proofs.

I forgot he was in the board so he might have access. Do you have proof I knew? Please give it to me

What? How was my tweet disingenuous? I had no idea Ufuk was an owner

Oh right, forgot about that. Thanks. Will direct my asks to him

Look at the history of Ruby Together. That org owned bundler and Rubygems (or at least Ruby together told us that) and got merged with Ruby central.

I’m saying that could be how ruby central saw the situation. I’m not trying to accuse anyone.

yeah. Good point. I agree with you that they could get ready for the "it went really badly" case, but they could have a conversation and discuss alternatives

Communicating early could trigger a retaliation, and that would also be a huge blow on the community trust of the service.

I understand the sentiment but I don't think is unanimous. I can understand both sides. If I had doubts where the trust lies in the current maintainers, if the organization removed one bad actor (or liability) it would be hard to know if the others aren't as well.

Bad behavior don't justify bad behavior, but the we are living in the "central organization control those OSS projects" world for at least a decade now.

I didn't see people going in defence of OSS when previous maintainers took over bundler from the previous team to put under Ruby together ownership. Neither when those maintainers rejects countless contributions based on "your company don't pay Ruby Together".

BTW, is isn't a takeover if RubyCentral was already the organization responsible for those projects. That was the case. Rubygems was created by RubyCentral founders, and even the maintainers that lost access said many times in order to contribute to those projects your company should pay rubycentral

I could imagine that if Matz didn't trust the ruby core anymore and he believed they were a threat to the supply gem he would remove commit access to all committers. It isn't pretty, agree, but it can be necessary.

Ah, and have a nice weekend as well. Always good to talk with you, even if we see things differently. I miss working with you, and really appreciate your opinion.

I agree with you there. I wish we didn't have to get to this point, and I probably would have done things differently. Maybe even going back years ago so we didn't need to have competitors in this space and our supply chain was properly funded and secure, with clear governance and more transparency

Not only that, rejected help from community members just because their employees were not paying Ruby Together or Rubycentral. And even when they paid, reject contributions based on "I don't agree with the company you work at, so your contributors aren't good"