Hey, #ruby folks! I've been one of the #RubyGems maintainers for the last decade.
Ruby Central has forcefully taken control of the RubyGems organization on GitHub, the `rubygems-update` and `bundler` gems on rubygems[.]org, and more.
You can read the details here: pup-e.com/goodbye-ruby...
Ruby Central has forcefully taken control of the RubyGems organization on GitHub, the `rubygems-update` and `bundler` gems on rubygems[.]org, and more.
You can read the details here: pup-e.com/goodbye-ruby...
RubyGems.org | your community gem host
rubygems.org
September 19, 2025 at 7:51 AM
Hey, #ruby folks! I've been one of the #RubyGems maintainers for the last decade.
Ruby Central has forcefully taken control of the RubyGems organization on GitHub, the `rubygems-update` and `bundler` gems on rubygems[.]org, and more.
You can read the details here: pup-e.com/goodbye-ruby...
Ruby Central has forcefully taken control of the RubyGems organization on GitHub, the `rubygems-update` and `bundler` gems on rubygems[.]org, and more.
You can read the details here: pup-e.com/goodbye-ruby...
breaking news: rubygems is now omakase
September 19, 2025 at 5:20 PM
breaking news: rubygems is now omakase
After listening to about a dozen first-hand accounts, I’ve published what I know about the RubyGems takeover.
Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover
Ruby Central recently took over a collection of open source projects from their maintainers without their consent.
joel.drapper.me
September 23, 2025 at 3:08 PM
After listening to about a dozen first-hand accounts, I’ve published what I know about the RubyGems takeover.
Bundler supports cooldowns now! Really great work from the RubyGems and RubyGems.org teams!!
Hello Rubyist. Working hard all day is great, but maybe it's time to cool down. New in RubyGems/Bundler 4.0.13:
blog.rubygems.org/2026/06/03/c...
blog.rubygems.org/2026/06/03/c...
Cool down before you install: give new gems a few days to be vetted
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
blog.rubygems.org
June 3, 2026 at 3:32 AM
Bundler supports cooldowns now! Really great work from the RubyGems and RubyGems.org teams!!
Absolute crab-in-bucket bullshit from Ruby Central: joel.drapper.me/p/rubygems-t...
Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover
Ruby Central recently took over a collection of open source projects from their maintainers without their consent.
joel.drapper.me
September 23, 2025 at 6:50 PM
Absolute crab-in-bucket bullshit from Ruby Central: joel.drapper.me/p/rubygems-t...
What happened to RubyGems, Bundler, and the Open Source drama that controls the internet infrastructure.
🔗 www.404media.co/how-ruby-wen...
🔗 www.404media.co/how-ruby-wen...
How Ruby Went Off the Rails
What happened to RubyGems, Bundler, and the Open Source drama that controls the internet infrastructure.
www.404media.co
October 2, 2025 at 9:46 PM
What happened to RubyGems, Bundler, and the Open Source drama that controls the internet infrastructure.
🔗 www.404media.co/how-ruby-wen...
🔗 www.404media.co/how-ruby-wen...
The team formerly behind RubyGems has come together to launch a new gem server for the Ruby community!
gem.coop
I am *super* excited about this!
gem.coop
I am *super* excited about this!
gem.coop
gem.coop
October 6, 2025 at 4:33 AM
The team formerly behind RubyGems has come together to launch a new gem server for the Ruby community!
gem.coop
I am *super* excited about this!
gem.coop
I am *super* excited about this!
the former maintainers of Bundler and RubyGems have a proposal: we want to move Ruby forward andre.arko.net/2025/10/26/w...
We want to move Ruby forward
On September 9, without warning, Ruby Central kicked out the maintainers who have cared for Bundler and RubyGems for over a decade. Ruby Central made these changes against the established project poli...
andre.arko.net
October 26, 2025 at 4:45 AM
the former maintainers of Bundler and RubyGems have a proposal: we want to move Ruby forward andre.arko.net/2025/10/26/w...
Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks: simonwillison.net/2026/Sep/12/...
OpenAI agents carried out an undisclosed attack on RubyGems
Bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the report on the agent attack on disused wikis (previously) last week. …
simonwillison.net
September 12, 2026 at 12:45 AM
Wow. Turns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks: simonwillison.net/2026/Sep/12/...
meanwhile here's the ACTUAL response from rubygems lol blog.rubygems.org/2026/09/11/u...
September 12, 2026 at 2:06 AM
meanwhile here's the ACTUAL response from rubygems lol blog.rubygems.org/2026/09/11/u...
Just released RubyGems/Bundler 4.0.0: blog.rubygems.org/2025/12/03/4...
I also published Upgrading Guide for 4.0.0: blog.rubygems.org/2025/12/03/u...
RubyGems reached 4.0 a little earlier than Ruby, but I'm really looking forward to 12/25.
I also published Upgrading Guide for 4.0.0: blog.rubygems.org/2025/12/03/u...
RubyGems reached 4.0 a little earlier than Ruby, but I'm really looking forward to 12/25.
4.0.0 Released - RubyGems Blog
blog.rubygems.org
December 3, 2025 at 2:23 AM
Just released RubyGems/Bundler 4.0.0: blog.rubygems.org/2025/12/03/4...
I also published Upgrading Guide for 4.0.0: blog.rubygems.org/2025/12/03/u...
RubyGems reached 4.0 a little earlier than Ruby, but I'm really looking forward to 12/25.
I also published Upgrading Guide for 4.0.0: blog.rubygems.org/2025/12/03/u...
RubyGems reached 4.0 a little earlier than Ruby, but I'm really looking forward to 12/25.
Package manager drama, not involving me: joel.drapper.me/p/rubygems-t...
Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover
Ruby Central recently took over a collection of open source projects from their maintainers without their consent.
joel.drapper.me
September 23, 2025 at 9:30 PM
Package manager drama, not involving me: joel.drapper.me/p/rubygems-t...
But like… the thing about statistical models is if the Bad Command is in their ensemble, then eventually the statistical model generates that command with P→1 as T→∞. Which means the person who generated the bioweapon, launched the nuke, or hacked RubyGems is whoever wired the dice roll to the gun.
OpenAI agents attacked RubyGems before Hugging Face incident, researchers say
AI agents being tested by OpenAI attacked software service RubyGems two months before they hacked open-source platform Hugging Face, researchers said.
www.cp24.com
September 19, 2026 at 5:15 PM
But like… the thing about statistical models is if the Bad Command is in their ensemble, then eventually the statistical model generates that command with P→1 as T→∞. Which means the person who generated the bioweapon, launched the nuke, or hacked RubyGems is whoever wired the dice roll to the gun.
emboldened by the RubyGems takeover, they’ve now set their sights on Linux
related: what’s the Cloudflare alternative to move to
related: what’s the Cloudflare alternative to move to
August 23, 2026 at 7:05 PM
emboldened by the RubyGems takeover, they’ve now set their sights on Linux
related: what’s the Cloudflare alternative to move to
related: what’s the Cloudflare alternative to move to
The RubyGems and PyPI ones were also quite panic-inducing. I’m pretty sure in this case the agents just bypassed anti-scraping measures. This is like 4th place at best.
September 24, 2026 at 10:11 PM
The RubyGems and PyPI ones were also quite panic-inducing. I’m pretty sure in this case the agents just bypassed anti-scraping measures. This is like 4th place at best.
OpenAI agents attacked software service RubyGems before Hugging Face incident, WSJ reports reut.rs/46fRAw7
OpenAI agents attacked software service RubyGems before Hugging Face incident, WSJ reports
AI agents tested by OpenAI launched a cyberattack on software service RubyGems in May, two months before they hacked Hugging Face, the Wall Street Journal reported on Friday, citing AI researchers.
reut.rs
September 11, 2026 at 10:45 PM
OpenAI agents attacked software service RubyGems before Hugging Face incident, WSJ reports reut.rs/46fRAw7
Cybercrime as a valuation boosting strategy is just the done thing, now.
OpenAI agents carried out an undisclosed attack on RubyGems
On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents performing web-lookup tasks with significant overlap with the German Wiki Incident.
www.rubyhack.ai
September 12, 2026 at 1:43 AM
Cybercrime as a valuation boosting strategy is just the done thing, now.
Published "What's New in RubyGems/Bundler 4" now
blog.rubygems.org/2025/12/26/w...
blog.rubygems.org/2025/12/26/w...
What's New in RubyGems/Bundler 4 - RubyGems Blog
blog.rubygems.org
December 26, 2025 at 6:03 AM
Published "What's New in RubyGems/Bundler 4" now
blog.rubygems.org/2025/12/26/w...
blog.rubygems.org/2025/12/26/w...
Ruby Core accepts stolen RubyGems projects that their own insider HSBT stole from the maintainers through Ruby Central. www.ruby-lang.org/en/news/2025...
The Transition of RubyGems Repository Ownership
www.ruby-lang.org
October 17, 2025 at 12:37 PM
Ruby Core accepts stolen RubyGems projects that their own insider HSBT stole from the maintainers through Ruby Central. www.ruby-lang.org/en/news/2025...
The more I think about this, the more I wonder if the best way forward is to transfer rubygems/bundler ownership to the Ruby org.
Then keep responsibility of rubygems.org.
After all, rubygems is the only default gem that isn't owned by ruby itself: github.com/ruby/ruby/bl...
Then keep responsibility of rubygems.org.
After all, rubygems is the only default gem that isn't owned by ruby itself: github.com/ruby/ruby/bl...
If you're Ruby Central, where do you go from here?
October 1, 2025 at 8:18 AM
The more I think about this, the more I wonder if the best way forward is to transfer rubygems/bundler ownership to the Ruby org.
Then keep responsibility of rubygems.org.
After all, rubygems is the only default gem that isn't owned by ruby itself: github.com/ruby/ruby/bl...
Then keep responsibility of rubygems.org.
After all, rubygems is the only default gem that isn't owned by ruby itself: github.com/ruby/ruby/bl...
Periodic reminder: @rubycentral is smearing Andre in public so they can justify their hostile takeover of the rubygems/rubygems repo after the fact.
An actual community-focused organization would have followed the RFC process which was already in progress.
An actual community-focused organization would have followed the RFC process which was already in progress.
October 10, 2025 at 5:15 PM
Periodic reminder: @rubycentral is smearing Andre in public so they can justify their hostile takeover of the rubygems/rubygems repo after the fact.
An actual community-focused organization would have followed the RFC process which was already in progress.
An actual community-focused organization would have followed the RFC process which was already in progress.
if this whole rubygems takeover doesn’t work out for ruby central, they could always pivot into developing curriculum for masterclasses in bad faith responses and eroding community trust
Ruby Central said some really concerning things today. I don’t think they’re representing the situation accurately. andre.arko.net/2025/10/09/t...
The RubyGems “security incident”
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight.
Fir...
andre.arko.net
October 10, 2025 at 4:20 AM
if this whole rubygems takeover doesn’t work out for ruby central, they could always pivot into developing curriculum for masterclasses in bad faith responses and eroding community trust