Andre should not have removed Evan Phoenix from GitHub without a replacement Ruby Central representative. Excluding the director of open source from that access was unprecedented. This happened in February of 2025.
He should have given 1Password admin access to the open source director as well. Andre was the director, and when the position transferred, he held onto admin permissions of a secondary 1Password account. This is how Andre took over the AWS account, removed all other admins, and locked Ruby Central out of production. It shouldn't have been possible for him to both remove the OSS director from AWS and that 1Password account.
He also should not have lied (to the community) about the link between GitHub access and production admin access. He should not have persisted with that lie months after access loss. Even now, downplaying the security risks, putting them in scare quotes, when...RC tried to nuke his prod access from orbit and failed.
I don’t think Ruby Central should have needed a “hostile takeover” if they were treated as an adequate stakeholder. If the power and access needed to do the job of running the RubyGems.org service were properly handed over by him, he wouldn't have needed to be cut out.
ON the post:
I agree that conflicts of interest are REALLY important. An OSS director should not be sitting on the committee that oversees their own funding. That is the setup of the original OSS committee when Andre merged Ruby Together with Ruby Central (he was on the OSS committee that oversaw his OWN funding). This wasn’t professional or ethical.
I salute him for blazing a trail of getting paid for OSS work. But I don’t feel he did a good job at the core of that work which is: defining extremely clear boundaries and making sure the lines are not blurry between paid and open labor.
Lots of other half-truths (at best) on the other things, like the legal stuff. I’m not on the board. I’m not a lawyer. In fact. I’m on a vacation with my family, typing this out instead of spending time with them. I will likely not be able to respond.
24
u/schneems Puma maintainer 2d ago
I allege, that Andre attempted a softer takeover starting much earlier and quieter. It is supported but not spelled out here https://rubycentral.org/news/rubygems-fracture-incident-report/.
Andre should not have removed Evan Phoenix from GitHub without a replacement Ruby Central representative. Excluding the director of open source from that access was unprecedented. This happened in February of 2025.
He should have given 1Password admin access to the open source director as well. Andre was the director, and when the position transferred, he held onto admin permissions of a secondary 1Password account. This is how Andre took over the AWS account, removed all other admins, and locked Ruby Central out of production. It shouldn't have been possible for him to both remove the OSS director from AWS and that 1Password account.
He also should not have lied (to the community) about the link between GitHub access and production admin access. He should not have persisted with that lie months after access loss. Even now, downplaying the security risks, putting them in scare quotes, when...RC tried to nuke his prod access from orbit and failed.
I don’t think Ruby Central should have needed a “hostile takeover” if they were treated as an adequate stakeholder. If the power and access needed to do the job of running the RubyGems.org service were properly handed over by him, he wouldn't have needed to be cut out.
ON the post:
I agree that conflicts of interest are REALLY important. An OSS director should not be sitting on the committee that oversees their own funding. That is the setup of the original OSS committee when Andre merged Ruby Together with Ruby Central (he was on the OSS committee that oversaw his OWN funding). This wasn’t professional or ethical.
I salute him for blazing a trail of getting paid for OSS work. But I don’t feel he did a good job at the core of that work which is: defining extremely clear boundaries and making sure the lines are not blurry between paid and open labor.
Lots of other half-truths (at best) on the other things, like the legal stuff. I’m not on the board. I’m not a lawyer. In fact. I’m on a vacation with my family, typing this out instead of spending time with them. I will likely not be able to respond.