Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover (opens in new tab)

Replace Shopfiy with Microsoft, Oracle or etc and surely you can see what worries people might have around a move like this. Just because a company has a positive imago does not mean that their motives align with that of the community.

There’s a lack of transparency playing out compounded by a poor job rolling out would should be the equivalent of boring corporate security bureaucracy.

Usually when this kind of stuff is rolled out, it’s agreed upon in some form and documented. Then when people are surprised, it’s a matter of pointing to the section in the doc that’s relevant and everybody goes on their way.

From the outside it appears this had none of that, so people are understandably surprised, sad, or angry. Since there’s a lack of transparency, people are filling in the blanks.

Totally on that one. Recently investments in homebrew almost turned it to be a paid tool.

I can totally see someone seizing the opportunity there. (And if you think it is a good idea, you are a terrible person)

I work for a small company who helps financially for ruby community, and they strongly advocate for other same size companies to do the same so there is balance.

It would be terrible for pypi, rubygems, brew and other repos to be used as political or economical tools.

Large companies can fork and keep living for a while or pay the cost. But for everyone else, including people developing ideas at home, it would be a shot through the heart.

So if you have a company that can help those orgs, press them to do so. If you have 5 USD to help, also do it. It makes the difference.

Aren't they a profit motivated company?

I'm not necessarily saying that's a bad thing. But it inevitably means they will not always be aligned.

I think more accurate is this:

One person who was a major funder of RubyCentral pulled funding because they were upset at RubyCentral platforming DHH. Neither that person, nor RubyCentral, had control over or ownership of the RubyGems software at that time, though RubyCentral operated the rubygems.org service, which uses the RubyGems software.

The corporation that is the other major funder of RubyCentral (Shopify) responded to this (taking advantage of the fact that this left them the sole significant funder of RubyCentral whom RubyCentral could not afford to alienate) to direct RubyCentral to, without any plausible claim of right, seize control of the RubyGems software repos, and kick out anyone who wasn’t a full-time RubyCentral employee from them.

It’s not about DHH except that that indirectly provided the opportunity, it’s about Shopify seeking to consolidate control of core Ruby infrastructure.

Thank you, this explains it for me. The situation is still stupid tough...

Cancelling DHH would be a stupid kneejerk reaction given how much of a major part of Ruby’s story is thanks to 37 Signals and their community involvement, including but not limited to Rails.

If this is the reason, I am behind this takeover. It’s weeding out bad actors that have a shortsighted mentality.

I do not want RubyGems and Bundler to become yet another pair of ideological playgrounds for people that spend more time protesting unrelated causes than actually _writing and developing software_.

I don't really think this is what happened. Seems pretty straightforward: Shopify wants to decide not just who runs RubyGems.org, but also the RubyGems repos. Separate teams (well, formerly)

> 1) People and entities with partial control over RubyGems attempted to cancel DHH

Ok there it is. That would explain why they’re being so cagey. I thought there had to more to this.

This article is just so politically charged and opinionated that it is hard to believe that it is coming on a "tech blog". Not to mention, a while back the very same company wanted its employees to have no political discussions at workplace in a widely published article.

I don't know why everyone pretends that having an incorrect opinion is some untouchable thing and we just have to respect it.

Everyone, you included, has opinions that they find unpalatable. Pretty much all of human history has been "cancelling" people for "incorrect opinions". I mean, what were the crusades? Or world war II?

There's no, like, gun to your head saying you have to respect things you don't respect. Some things are just not respectable. You're allowed to be like "no" and then decide to get as far away from the person as possible.

And, relatedly - you don't have to run away. You can push them away.

Its not really fair that crazy people are allowed to say crazy things then we, normal people, have to take the high ground and walk away. What if I don't want to walk away? Why do I have to leave a project like it's the plague because you said something insane?

Anyway, just my two cents.

Also, just to be clear: I don't think DHH is crazy or evil. I'm addressed the broader concept, not this specific case.

The victim mindset of these people is on another level. DHH presents the openly transphobic Graham Linehan as some kind of free speech victim.

Oh, I should read the actual tweet? Funny the actual tweet is so much worse than I imagined.

If a trans-women is in a space that she is legally entitled to be in, according to him one should:

> Make, a scene, call the cops and if all else fails, punch him[he means the trans-women] in the balls

He is literally telling people to be violent against trans people. And then cries when actions have consequences.

These people are like the school yard bully who will start a fight with you then cry "timeout, timeout" when you punch back. And go to the teacher to convince you they are the real victim.

As far as I can tell, the direct chain of events preceding this coup-like event was:

Ruby Central hosts DHH at RailsConf in July --> Sidekiq withdraws funding from Ruby Central --> Ruby Central is essentially entirely dependent on Shopify.

    The "what" seems to be purely a reaction to this article DHH posted: 

Strictly speaking, DHH's September blog post could not have driven this unless there was a time machine involved. However, DHH has made some contentious political statements in the past so perhaps what you're saying is true in a larger sense.

It's certainly possible that Shopify's actions had nothing to do with either side's politics in particular, and they decided it was simply safer for them to control Ruby Cental and RubyGems rather than rely on an independent organization with unstable funding (that they were basically solely funding anyway according to the article)

I don't love that outcome. As a Ruby fan, I don't want Ruby or bits of its infrastructure controlled by a particular organization.

He's been posting controversial stuff for quite a while, you certainly can't distill this to one blog post.

DHH stopped trying to cultivate an inclusive community some time ago. The ruby community can ill afford to drive away more prominent maintainers, yet that is what is happening here, as the corporate interests are aligned with DHH even if the rest of the community is not.

It’s pretty galling to see someone who’s never lived in London talk mad shit about it. London is my home, not DHH’s. He knows fuck all, which is why he repeats tired, overcooked falsehoods.

What he’s saying is that he only considers white British to be legitimately British. He would look at former Prime Minister Rishi Sunak and current Mayor Sadiq Khan and dismiss them as insufficiently British. Too much melanin I guess.

He’s even excluded white people from elsewhere who were born in Britain if they have a non-British ancestor. So according to DHH and his ilk Nigel Farage’s children wouldn’t be counted as white British despite having white mothers (Irish and German), being born to a British father in Britain and living all their lives in Britain.

What the fuck is the point of dividing people like this? “Just an opinion” my ass. DHH and people like him are dehumanising my fellow Londoners.

So he is a Tommy Robinson fan? Yikes.

Speaking of incorrect opinions, it's pretty hard not to read this and conclude his "no politics at work" initiative was just him seeing his company was full of liberals he found annoying and this was his scheme to kick them all out.

I don't know about this interpretation. The blog post points out that one of the conditions of the continued funding by Shopify was literally removing one of the specific maintainers of the stolen tooling who had been working on it them for a decade, and it provided ample evidence that this was funding that essentially was the only thing keeping the service afloat. It's kind of hard to imagine threatening to sink the entire RubyGems service unless the people in charge of it steal ownership of a related but separately owned tool to force out one specific person as "good intentions" but with "poor communication" when it's presented the way it has been by the perpetrators.

To preempt any potential objections on the basis of the removed funding from Sidekiq based similarly on a relationship with a single person, there are two pretty crucial differences: the funding was withdrawn because of the relationship the organization had itself with someone, rather than someone involved with something that literally had to be stolen to terminate their involvement, and the funding withdrawn by Sidekiq was done openly with umambiguously communicated intentions. Deciding to not give money to an organization because of an actual choice that they made and tell everyone that is just being transparent about your morals; secretively pressuring an organization to exploit their existing connections to force someone out of a project they don't own and then having them represent it publicly as something they chose to do on their own for the greater good might as well be out of the playbook of organized crime or foreign intelligence services.

I got into Ruby and the community in 2006.

I aspired to be like Jim. We all should.

He made time for anyone who wanted to engage him in a sincere discussion. He helped a lot of newer people. He wrote beautiful tools that we still use.

He embodied MINASWAN. That has been the core of Ruby's community.

DHH has been pretty damn far from that.

Did many of us find Ruby through Rails? Sure. Does that mean that Ruby should be stewarded by someone who is intolerant and therefore exclusionary? No.

That's the opposite of MINASWAN.

> It is a lot less welcoming when DHH repeatedly uses his platform to say that I shouldn't exist or have equal rights.

Can you point to any of his blog posts that says this ?

How is his code?

I guess I’m so old that I remember not paying much attention to personal lives and looking at code contributions and collaboration behavior. I think that being a sensitive collaborator who builds changes was more relevant than swearing at people or saying rude things.

I once worked for a company where one developer hit another in the face with a keyboard. Was it wrong, yes of course. But we still delivered a pretty decent product.

I don’t really care if you, or others feel I should exist or not. Or whether they think I should or shouldn’t have rights, unless you mean permissions to change and maintain code.

Is he known to, like, reference his politics in his conference talks or something?

Someone linked an article above that is worth a read - He's said some pretty horrific stuff about minority groups & is echoing discredited sentiment on immigrants and other minorities. It's worth a read.

https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...

He's voicedly MAGA-adjacent, has often written against the evils of multiculturalism and how happy he was about Trump winning the elections.

I don't think he's a white supremacist, but it is understandable that some people don't like his ideas.

I've formed a positive opinion of Parham's character by the way he's conducted himself over the years. And Solid Queue isn't a serious Sidekiq replacement for the types of high volume applications where you'd want a Sidekiq license; I doubt he even sees it as a threat.

Also the fact that DHH complained about not wanting to live in London because of how many non-whites there are, praising violent far-right agitators, and repeating debunked racist claims.

> HH has been going off the deep end with his rhetoric for years, the current political environment has made it so that he can't be ignored anymore.

But Shopify is also right wing in its executive team, and via these move they appear to be support DHH:

https://pressprogress.ca/shopify-executives-right-wing-media...

https://disconnect.blog/the-conservative-tech-alliance-is-co...

And yeah, Shopify is going to protect DHH because DHH is on Shopify's board:

https://www.shopify.com/news/david-heinemeier-hansson-board

It would be more accurate to say that the rift is between intolerant progressive activists and people who just want to work on the code without getting politics involved.

Except Matz is aligned with DHH, Tobi and others. I think lots of people confuse "nice" with "supporting every weird American left-wing cause pushed by certain corporations". Keep in mind most of the people who actually run the Ruby ecosystem and drive it forward aren't American, and it's mostly Americans whining about it.

Also, people opposing it (Sidekiq, the guys starting "rv", etc...) have a vested financial interest in opposing Rails and rubygems...

Its especially wild given how their action in pulling funding seems to have been a prime motivator for this power grab: in their attempt to boycott DHH, they quite literally handed him the keys to the kingdom.

I don't like DHH (for whatever reason), and I would never want to spend my own money on 'platforming' him. It seems pretty reasonable that someone/company applies discretion to which community events they sponsor.

Spinel's "rv" seems to be just that—obviating Ruby Central.

How is this good for anyone? Ruby is an excellent language and the community is largely the best I’ve experienced of any language.

Yes there is drama, recently especially, but there have been some fantastic people involved for decades

There's ruby the tech and there's ruby the community.

The former is mature, robust, fit for purpose.

The latter is... messy.

DHH's prominent role in the ecosystem and full throated endorsement of reactionary politics has alienated a lot of people who might otherwise have been invested in that community, and this latest maneuvering seems downstream of all that.

At this point the tension between corporate interests (and by extension DHH, who is a central player in that group) and open source / community interests has become frustratingly high, and it all seems like it could have been avoided.

It doesn't mean ruby is dead or even dying, but you can't blame anybody for looking at this and just noping right out over to a community without such drama.

What'd Ruby do to you?

Ruby promised programmer happiness and delivered programmer warfare.

Predating the current hostile takeover: •••the vitriol directed at early critics like Zed Shaw •••mysterious departure of _why the lucky stiff •••the contentious Code of Conduct •••DHH •••uneasy truce after the toxic tribalism of the Rails vs. Merb

There's more, but the linked article can send you down more interesting rabbit holes than more bullets on my list

Basically, yes.

It is murkier as the involvement of some of the original creators in Ruby Central is there, so there are claims to being the original copyright holder applicable to some areas by a very small number of individuals, none of which who are the newly added maintainers, or Ruby Central as a whole entity.

Having been there, I don't know what you missed but it sounds like a lot.

The project promised a lot in the beginning and some folks new to a language like Ruby were so enthused by what they could do that they didn't pay much attention to the admin drama at the beginning.

Your critique of the author's writing style doesn't seem like your strongest argument.

> It's true Ruby Central was a fiasco and the maintainers should have been treated better.

Treated better as in ... not removed from their own projects? Treated better as in... not kicked out of things they built by someone else who has something to gain?

Treated better is not the phrase to describe what should have happened here.

It also skipped over the elephant in the room which is NPM's security issues.

This was likely a reaction to a mix of NPM + culture war/deplatforming, where power player got nervous and decided to clamp down on rubygems security to insulate it from hypothetical bad actors.

These kind of statements frustrate me. They are kind of manufactured consent statements. I likely don't agree with DHH positions as shared here, but when did we decide platforming very left-leaning positions is good, and platforming very right-leaning ones is bad? I wouldn't even mind if the position was that platforming either is good/bad. The framing here begs the question.

I'm sorry but if DHH posted some inflammatory articles maybe it's better to post those articles for people to judge themselves, than to post what someone else thinks.

Having read stuff from DHH for a long time, this does not surprise me in the least. It just feels like he picked the right time, zeitgeist-wise, to fully come out of the closet.

I distinctly remember a specific Twitter comment, maybe 7ish years ago, that solidified my view on DHH as a person. It was a thread about remote work. Someone from South America commented trying to be nice to David, saying something like "you should work remotely from Chile, it has a great Ruby community" etc, to which his response was "I've no interest in living in a 3rd world country".

Notch-esque politics aside, that was mean-spirited, inconsiderate behavior which should not be applauded. From that day I strongly sensed that was who he truly was.

DHH is on Shopify's board now:

https://www.shopify.com/news/david-heinemeier-hansson-board

Shopify's support for DHH's world view makes sense. Shopify's executive team has been right-wing for a while now:

https://pressprogress.ca/shopify-executives-right-wing-media...

https://disconnect.blog/the-conservative-tech-alliance-is-co...

He's really gone off the deep end and evidently knows fuck all about London or the patriotic march he's discussing.

Are you sure you posted the right article? There's nothing about Ruby or RubyGems in it.

He's regurgitating racist tropes. Whether he knows that or not I don't know. He might be racist, it might just be Dunning-Kruger around whether he can speak authoritatively on social issues (in his post there's no attempt at original thought, just copy-paste).

But...it makes it a little difficult to build an inclusive open source community with that at your head.

‘very fine people on both sides’ - DJT

I can concur, I have spent some time with him IRL. He is one standup guy, and his ethics are inspiring.

Seconding this. No-nonsense, good dude. Shaking his hand was more of a personal goal than DHH.

So HSBT was the owner? And transfered ownership?

At the GitHub Enterprise level, you can see that reflected if you look at any of the users profiles https://github.com/mghaught

> and I'm not sure it matters to the current kerfuffle

I guess I find it a bit strange that it's so fuzzy who owned the GitHub repo.

So it was owned by a GitHub organization, and someone should have owned that organization no? Maybe the person that created it initially?

You can have more than one person with a role that allows to change ownership of repos owned by an organization, was that the situation here? Did multiple people had that permission and one of them re-owned the repo to themselves without any other knowing?

I say that because, I don't normally consider every code contributor to a repo, or even admin the owner of a repo.

If I create an open source lib, and then create a GitHub repo for it, and contributors come in, to help commit code, do PRs and even manage the repo, and later I decide to revoke everyone else's access, as the owner, like it's fine. Sure maybe some of the admins might wonder what's up, why I don't trust them administering the repo anymore, but it's my repo.

Here I'm struggling to identify whose repo is it? And was the repo owner kicked out of their own repo, so this is a takeover? Or did the owner just kick out others ?

> David Black

now there's a name I haven't heard in a while! he was definitely one of the prominent people keeping the ruby mailing list fun and friendly back in the day; I miss that early ruby era where everyone was enthusiastic about how nice the language felt to use.

The moment I saw Arko's name I knew what this was about, the petty culture war that some in the Ruby community engage in, and I was right. My only surprise is that something is finally being done.

Thank you!

Status quo administrators had their access revoked without their consent and without cause. That's malice.

Quote:

> In his blog post, André says, “For the last ten years or so of working on Bundler, I’ve had a wish rattling around: I want a better dependency manager. It doesn’t just manage your gems, it manages your ruby versions, too. It doesn’t just manage your ruby versions, it installs pre-compiled rubies so you don’t have to wait for ruby to compile from source every time. And more than all of that, it makes it completely trivial to run any script or tool written in ruby, even if that script or tool needs a different ruby than your application does.”

> Bluesky threads reveal that Rafael França (Shopify / Rails Core) saw this tool as a threat, saying “some of the “admins” even announced publicly many days ago they were launching a competitor tool [rv] and were funding raising for it. I’d not trust the system to such “admin”.”

So a dev was innovating to make better tool to meet their needs (which is what most open source maintainers are generally doing all day), and then some guys immediately jumped to the possibility that they would then actively sabotage RubyGems? Whoa, that is insane.

Trying to kill innovation and a start-up out of fear doesn't sound like Shopify's branding in the media.