Ruby Central's Destructive Legacy

30 Jul 2026

Ruby Central's Destructive Legacy

At conferences and meetups, and successful conversations online, galore Ruby developers person asked maine astir Ruby Central and my disagreement pinch them. This station is my effort to reply the questions I’ve been getting complete and over, covering: 1) what is Ruby Central doing now? 2) has the conflict complete Bundler and RubyGems been resolved? 3) what has Ruby Central said astir the dispute? and 4) what tin Ruby developers do now?

What is Ruby Central doing now?

To talk astir what Ruby Central is doing now, we request to commencement pinch a spot of humanities context. What was Ruby Central doing earlier this saga began? About 18 months ago, Ruby Central:

• ran 2 conferences each year, RubyConf and RailsConf
• had an Open Source Committee pinch 3 members (Ufuk, Gabi, Mike)
• funded 7 part-time organization OSS contributors (André, Arun, Ellen, Gift, Irene, Josef, Martin)
• funded 3 full-time OSS developers (Colby, Samuel, David)
• coordinated those 10 OSS contributors crossed 3 awesome OSS projects:
  • RubyGems
  • Bundler
  • RubyGems.org

Then, astir 10 months ago, Ruby Central began what halfway squad personnel Ellen Dash called a “hostile takeover” of the RubyGems, Bundler, and RubyGems.org unfastened root projects, seizing power of the projects and locking retired the squad that had nurtured and maintained them for complete a decade.

Today, 10 months aft their takeover, Ruby Central has:

• lost 2 of 2 conferences, aft ending RailsConf, cancelling a important information of the past RubyConf, and providing nary early convention locations aliases dates for the first clip successful decades
• lost 2 of 3 awesome OSS projects, by transferring Bundler & RubyGems distant to Matz
• lost 9 of 10 contributors to unfastened root work, including:
  • 6 of 7 operators of RubyGems.org (André, Samuel, Arun, Josef, Ellen, Martin)
  • 2 of 3 full-time contributors to OSS (Samuel, David)
  • 2 of 2 OSS writers (Gift, Irene)
• lost 3 of 3 members of the Open Source Committee (Gabi, Mike, Ufuk)
• lost 5 of 7 board members (Kinsey, Valerie, Naijeria, Ben, Ufuk)
• lost 3 of 3 Executive Directors (Adarsh, Chelsea, Shan)
• lost 2 of 2 awesome financial sponsors (Sidekiq and Shopify, though Shopify seemingly conscionable returned aft a 9 period break)

Unlike galore organization non-profits (including the Python Software Foundation), Ruby Central does not clasp elections for their committee of directors. Despite rewriting their bylaws wholly this year, caller board are still selected exclusively by existing directors, pinch nary nationalist process for input aliases feedback. The existent committee consists of conscionable 2 of the 7 members who initially approved the dispute takeover, positive 3 caller members chosen by the erstwhile committee (Brandon, Jey, and Ran).

Based connected Ruby Central’s public announcements, they person added precisely 1 caller programme aft ending some conferences and transferring distant half of their unfastened root software: a caller information project, funded by a assistance from Alpha-Omega. The information project’s extremity is to usage Anthropic’s Project Glasswing to hunt for information issues successful gems that person already been published. In their first monthly study for June, they reported uncovering a full of 5 vulnerabilities, pinch 1 rumor astatine mean severity, and 4 astatine debased aliases unclassified severities.

Ruby Central’s existent sponsorship drive, the Ruby Alliance, has recovered 3 members consenting to join: Gusto, Thoughtbot, and (very recently) Shopify. What nary of the sponsorship announcement posts person mentioned is that Gusto and Thoughtbot employment 2 of the 5 Ruby Central committee members. David Corson-Knowles is some a committee personnel and a Senior Staff Engineer astatine Gusto. Ran Craycraft is not conscionable President of the Ruby Central board, he is besides Managing Director, Americas astatine Thoughtbot. That intends the committee members who allocate the sponsorship money are besides providing that sponsorship money, a conflict of liking which neither the companies nor Ruby Central person disclosed. The last sponsor is Shopify, coming backmost 9 months after it was reported they demanded Ruby Central commencement this disaster successful the first place.

Has our conflict been resolved?

No, our conflict has not been resolved. Since past October, Ruby Central has been threatening to writer me. They person not withdrawn that threat arsenic of today.

The halfway of our conflict is that past September, Ruby Central hijacked the Bundler and RubyGems GitHub projects from their maintainers of complete 10 years. When I informed Ruby Central that I ain the sanction Bundler, they retaliated pinch a threat to writer maine for supposed “hacking”, a position I person ever disputed.

Ruby Central has stated they will only retreat their threat if I driblet my declare they infringed the sanction Bundler. After I besides questioned if my activity arsenic a contractor had been allowed by authorities labour law, they additionally started demanding that I driblet immoderate claims regarding employment arsenic well. So far, Ruby Central has consistently said they will only retreat their suit threat if I springiness up my infringement declare for Bundler and immoderate imaginable backmost salary I judge they beryllium me.

When the suit threat did not make maine driblet my claims, Ruby Central past chose to springiness distant the Bundler gem and rubygems GitHub repo to Matz. After that, each of the erstwhile maintainers made a caller connection to settle. Ruby Central ne'er replied to our offer. Instead, they restated their original offer, and only to me: they would retreat their threat to writer only if I dropped each of my claims. I did not accept, and aft 4 months pinch nary further progress, I wrote a nationalist update.

In consequence to my post, Ruby Central did 2 things astatine once:

First, Ruby Central told maine they were actively seeking extracurricular backing to salary a colony to maine that would extremity our dispute. They asked maine for an magnitude that would afloat compensate maine for my attorney’s fees, the magnitude they mightiness beryllium successful backmost pay, positive compensation for an further six months aft I was fired. With thief from an expert, I calculated an magnitude astir $450,000, and provided that number arsenic requested.

Despite providing that number, I person ne'er asked for that magnitude of money. I provided that number astatine Ruby Central’s request, truthful they could activity funding. What I person alternatively asked for, consistently, is an apology for the attacks connected my estimation without evidence, and the acold smaller magnitude of reimbursement for my attorneys’ fees.

Second, astatine the aforesaid clip arsenic they sought backing for a settlement, Ruby Central besides reported maine to the FBI done their lawyer, requesting that I beryllium criminally investigated. On March 9, 2026, Ruby Central’s lawyer informed my lawyer that he had made the report, and suggested I would request to prosecute a criminal defense attorney. As acold arsenic I person been capable to learn, Ruby Central’s lawyer was not capable to supply immoderate grounds to the FBI pinch his report, since Ruby Central has not been capable to find grounds that I caused immoderate harm during their 3 audits of the RubyGems AWS account.

Unfortunately, it is intolerable to retreat a study to the FBI. Despite Ruby Central’s later connection to maine that they don’t intend to prosecute the FBI report, they gave up the expertise to make that determination erstwhile they revenge the study — it’s up to the FBI now, not up to them.

A fewer weeks aft saddling maine pinch a imperishable anticipation of criminal prosecution by the FBI, Ruby Central ran retired of money. Their station said they “want to move guardant together”, but did not return immoderate action aliases reply immoderate questions regarding their past actions. Nonetheless taking that station arsenic a promising sign, I offered Ruby Central a caller action to resoluteness our disagreement.

I did not inquire them to return Bundler. I did not inquire them for adjacent costs nether employment law. I didn’t moreover inquire for an apology. Instead, I asked for 1) nationalist confirmation that I did not origin immoderate harm to RubyGems, and 2) reimbursement for the lawyer fees I person had to salary because of their threatened lawsuit. Ruby Central past ignored that post, and aggregate attempts to scope out, for six weeks.

After six weeks, Ruby Central sent maine a rerun of their colony offer, pinch immoderate circumstantial restrictions: they would retreat their suit threat if I driblet my declare they infringed the Bundler trademark, driblet my declare they violated employment law, and work together to non-disparagement that binds maine but does not hindrance Ruby Central, alternatively only circumstantial individuals presently associated pinch them.

This connection did incorporate 1 caller twist. Ruby Central wrote that if I accepted they would limit their practice pinch the FBI, offering to “discourage the filing of criminal charges, and if an investigation is opened aliases charges filed, cooperate only to the grade required by law”. There’s conscionable 1 mini problem pinch that offer: galore authorities and national laws make it a crime to work together to immoderate limits connected practice pinch a criminal investigation. Needless to say, I could not judge specified a settlement.

Since Ruby Central can’t retreat their FBI study (because it’s retired of their hands now), and they can’t springiness backmost the repos they took (because they don’t person them anymore), and they can’t salary immoderate benignant of compensation (because they don’t person immoderate money), I was astatine a spot of a loss. What could Ruby Central moreover do to effort to resoluteness this business that they had created?

In the end, I responded pinch a counter-offer of my own: I would driblet my infringement declare against Ruby Central complete their usage of the sanction Bundler, and I would driblet my declare Ruby Central violated employment law, if they would retreat their threat to writer maine and people an apology. I asked them to apologize for publically accusing maine of harming RubyGems.org without evidence, apologize for claiming I tried to get personification PII erstwhile I did not, and apologize for breaking the Bundler and RubyGems governance to execute their takeover. Surprising me, Ruby Central did not entity to the apology I requested.

Unfortunately, Ruby Central has continued to insist connected a non-disparagement statement that binds me, but does not hindrance Ruby Central. I was forced to reply that I could not judge specified an unbalanced agreement.

It has been 30 days since my counter-offer. While RubyConf did return up 3 of those days, Ruby Central has not replied for the afloat 30 days. Their lawyer promised to supply a timeframe for their consequence wrong 1 day, and has not done moreover that. A period pinch nary consequence points to a different benignant of resolution: an incredibly disappointing bequest for the shattered remains of a once-legendary organization.

What has Ruby Central said astir this?

Even aft each of the consequences described here, Ruby Central has ne'er acknowledged that maintainers of complete 10 years should not person been thrown retired of their ain projects. Ruby Central either does not know, aliases is not consenting to admit, that they needlessly attacked and removed the existing squad erstwhile we could person fixed them each the thief they needed to unafraid their systems. Ruby Central’s nationalist posts to day carefully connection nary apologies to the maintainers.

The sole nationalist justification they person ever offered for this dispute takeover is that they did this “to amended security”. Unfortunately, Ruby Central removed each of the experts who could person ensured they executed their takeover securely. When I responsibly disclosed Ruby Central’s nonaccomplishment to unafraid their systems, which embarrassed them, they retaliated by publicly accusing maine of “hacking” and privately preparing to writer me.

As of this writing, Ruby Central has conducted nary little than three separate audits, seeking grounds that I caused immoderate benignant of harm. They person not recovered immoderate evidence, because (beyond revealing Ruby Central’s embarrassing nonaccomplishment to unafraid the RubyGems.org service) I did not take, damage, aliases harm immoderate portion the RubyGems.org service.

During the aggregate months wherever Ruby Central ignored my offers to settle, aft baselessly reporting maine to the FBI, they nevertheless published a “Fracture Incident Report”, which states it was written to “provide closure”. Unfortunately for that closure, the study does not explicate immoderate of the reasons Ruby Central chose a way that destroyed their sponsorships, their volunteers, their unfastened root projects, their staff, and their committee of directors.

For example, what actions did the committee really ballot to approve? What did Ruby Central expect to gain? Why did Ruby Central azygous maine retired personally, while ignoring the different maintainers? Why jump consecutive from being embarrassed to threatening a lawsuit? What could perchance warrant involving the FBI while location is nary grounds of immoderate harm? The study answers nary of these questions.

Instead, Ruby Central continues erstwhile Executive Director Shan Cureton’s nationalist policy, moreover beyond her departure: nary 1 deserves to cognize why immoderate of this happened, because “they don’t request to person the story, and it isn’t their communicative to have”. According to Ruby Central, I don’t merit to cognize why this happened, nary of the erstwhile maintainers merit to cognize why this happened, and nary 1 other successful the Ruby organization deserves to cognize why this happened. Including you.

What tin we do astir this?

There was a clip erstwhile Ruby Central did much activity to support the Ruby organization than immoderate different statement successful the United States. In 2004, erstwhile I first started learning Ruby, I was amazed to observe that RubyConf 2005 would beryllium successful San Diego, adjacent capable for maine to attend. I rounded up my only 2 friends who besides liked programming, and we went together.

I saw Matz springiness a talk proposing the -> “stabby lambda” syntax. I tried to understand call_cc successful a talk fixed by Jim Weirich utilizing a Nintendo 64 to show continuations via The Legend of Zelda: Ocarina of Time. I saw the Rails halfway team, moving toward releasing Rails 1.0 successful December of that year. I joined IRC connected Freenode, wherever I made a immense number of Ruby friends I still person today, complete 20 years later. I met different students who were attending from adjacent UCSD, and we are besides still friends to this day.

Just complete a twelvemonth later, I attended the first RailsConf successful 2006. I met immoderate strangers, we became friends, and 1 of them invited maine to use to activity astatine his company. That became my first full-time job, group an unrealistically precocious modular for managers and co-workers, and made maine moreover much friends that I still talk to regularly today.

Ruby Central’s conferences changed my life, successful the champion measurement possible. The organization that grew retired of the events, talks, online chats, and shared codification inspired maine to lend backmost — to thief create and vessel Bundler 1.0 successful 2009, to support Bundler for the adjacent 15 years, to activity connected RubyGems and RubyGems.org for complete 10 years, and to recovered the non-profit Ruby Together to attraction connected backing and attraction for 7 years.

When Ruby Central reached retired to definitive liking successful merging pinch Ruby Together, and combining my unfastened root programs pinch their convention programs, I was flattered. I agreed to the merger based connected their spectacular way grounds of conferences and community-building from 2001 to 2021.

It’s incredibly sad that today, conscionable a fewer years later, Ruby Central has zero upcoming conferences for the first clip successful their 25 twelvemonth existence. It’s moreover much sad that this full dispute, acold from strengthening Ruby Central arsenic they claimed to want, has alternatively attacked the very community governance they were expected to beryllium providing.

Even beyond getting thrown retired of the task that I helped create, aft fundraising for a decade to support it alive, Ruby Central’s betrayal of the organization hurts. It hurts to spot not conscionable me, but a full squad of maintainers driven distant from the projects they person nurtured and developed for truthful galore years. It hurts to perceive that moreover aft each of this, it was done for nary existent logic anyone tin explain, and produced nary existent benefits that anyone tin constituent at. That’s nary measurement to rebuild trust, aliases to support and turn a community.

The Ruby organization deserves better.

We tin create unfastened root projects governed openly by their maintainers, for illustration gem.coop. We tin build caller devices that make utilizing Ruby amended for everyone, for illustration rv aliases Ruby Butler. While I person nary liking successful creating immoderate much Ruby non-profits, I dream 1 time location will beryllium Ruby organization organizations wherever the board are elected by the community, possibly for illustration the Python Software Foundation board.

We can’t return to the past, erstwhile Ruby Central’s conferences were celebrated and astonishing organization events, and erstwhile Ruby Together supported unfastened root projects without claiming to ain them. Instead of spending our clip trying to bring backmost the aged days, let’s activity together to build Ruby a brighter future.

My clip to constitute is sponsored by Spinel. If your institution could usage immoderate world-class expertise connected gems, Rails, CI, aliases developer productivity, cheque retired spinel.coop and prosecute us!