That’s what it looks like to me, but I haven’t yet seen a good explanation of their motive. Why would the development of `rv` be such a threat to them?
I know specific individuals hate Andre and have had beef with him for years, but it’s hard to see what might have motivated Shopify and specifically Ufuk Kayserilioglu to carry this out.
Some estimates are about two million but I think that’s an extremely loose definition of Ruby Developer.
I run rubyschema.org which maintains the rubocop JSON schema that’s pulled via schema store. I can see there are about 21k unique downloads each month, which I think is a pretty reasonable lower bound.
Most text editors will pull this schema when opening a project with Rubocop.
> Ruby Central’s actions during this period were taken in response to a breakdown in a working relationship with an individual who had significant access to infrastructure and code.
This is the first time they’ve actually admitted that this was all about Andre.
> At the time, we believed a serious risk had been introduced to RubyGems and related services.
And what’s more, they didn’t even try to remove Andre’s access to AWS until he told them to.
> As stewards of services relied upon by millions of developers, we took that risk seriously and made the decision to act quickly to protect that infrastructure.
That’s not what Freedom said. Freedom said they needed to act quickly or lose funding.
> A full, independent security audit has now been completed. The review was ultimately inconclusive because key logs required for a complete analysis were no longer available. We recognize that this creates continued uncertainty.
This makes it sound like there was some big security incident that they had to respond to. What actually happened is they forgot to remove Andre’s access to AWS and he told them and then they removed it. That’s it.
> Our intent was to stabilize a situation that was quickly escalating to work toward an amicable resolution.
If you watch the meeting (linked above) it’s clear that’s not what they were doing. This is a new spin they’ve come up with to justify it.
> Ruby Central did not initiate litigation and has consistently sought a path that would allow the community to move forward without prolonged conflict.
That is not what I’ve heard, but I’ll wait for others to post details of what’s happening in this space.
> At the same time, we recognize that aspects of how this situation was handled and communicated did not meet the expectations of the community.
They keep trying to admit fault in communication as if communication was the problem in an attempt to distract us from the fact they literally stole open source projects in a hostile GitHub takeover and used their privileges as administrators of RubyGems.org to take over the `bundler` package.
It can be a mistake though to assume that the DOM hasn’t changed since it was rendered. Browser extensions, ad blockers and other JavaScript can modify the DOM.
I know it’s more expensive, but it’s like 1ms to render a document on the server and 3ms to morph it in the client. If you keep an SSE connection open, Brotli compression is very effective when you send almost the same HTML again and again.
I don’t hate SPAs, I just think some apps are better off being MPAs. I wouldn’t build a todo list app as an MPA. But many apps really are just CRUD forms and tables.
My specific use case was building a form where each change to an input would fetch a new copy of the form from the server and morph it in place.
It means the server-side code can be really simple. You can make parts of the form depend on the values of other parts. For example you can show/hide a section based on a checkbox or fill a select with options based on a previous selection.
Because it was a form, it was really important to maintain object identity and state perfectly so the user would not be interrupted.
I’m not talking about who wrote the code. Hundreds of people wrote the code, that’s not particularly relevant. I’m talking about who had maintainership of the code and how those maintainers had agreed to govern the project.
What was your maintainership status when this all kicked off? Were you one of the owners removed by HSBT?
I believe the quote pulled from my article is true. Freedom’s original article lines up with what other people told me. I know he’s tried to retract it, but I don’t trust him to be truthful in this matter. He has lied about other things like the takeover being necessary for security.
Ruby Central is making legal threats to its critics, so I hope you can see why people don’t feel safe to come forward on the record.
I can tell you that two people with direct knowledge of the situation told me that Shopify demanded that Ruby Central take full control of the RubyGems GitHub organisation and packages.
You can believe that I am lying if you want. But I can’t directly cite my sources in this case.
Only “minor” because they were in fact wrong about André being a risk. Had he been a real risk, this would have been about as major as it gets. They left him with root production AWS console and full production database access.
Fortunately he’s a standup guy and not a real security risk, so he emailed them immediately to let them know.
Shame on the flaggers.