WEBVTT 1 00:00:04.559 --> 00:00:08.599 Hey, folks, welcome back to Ruby Rogues this week, it 2 00:00:08.640 --> 00:00:11.119 looks like it's just me. We kind of took a 3 00:00:11.119 --> 00:00:14.080 break from recording for a little while, but I'm back 4 00:00:14.160 --> 00:00:16.559 at it and I had some stuff to talk about. 5 00:00:16.600 --> 00:00:20.039 So I'm going to just jump in and talk about 6 00:00:20.079 --> 00:00:21.800 some of the stuff that's going on out there in 7 00:00:21.800 --> 00:00:25.039 the Ruby community, just to give a little bit of 8 00:00:25.079 --> 00:00:30.120 context on how I expect this to flow effectively. I'm 9 00:00:30.160 --> 00:00:31.719 just going to kind of explain what I've been able 10 00:00:31.719 --> 00:00:36.759 to gather is happening. I'll probably interject my opinion or 11 00:00:36.759 --> 00:00:41.079 feelings on things as I go, and then at the end, 12 00:00:41.119 --> 00:00:43.200 I'll give some conclusions as far as what I think 13 00:00:43.479 --> 00:00:46.560 we ought to be thinking or doing regarding the situation 14 00:00:46.679 --> 00:00:50.920 with Ruby Central and Ruby Gems. I'm also going to 15 00:00:50.960 --> 00:00:55.679 be gearing up and recording more episodes, and I'd like 16 00:00:55.719 --> 00:00:57.799 to add another host or two to this show, so 17 00:00:57.840 --> 00:01:00.880 if you're interested, feel free to email me Chuck at 18 00:01:00.960 --> 00:01:04.400 topendevs dot com. I've also got some other stuff coming 19 00:01:05.000 --> 00:01:06.719 just to kind of give you all a heads up. 20 00:01:07.000 --> 00:01:09.239 I'm going to start recording a Ruby Tip of the Day, 21 00:01:09.599 --> 00:01:13.599 and so that'll be a daily podcast. It'll probably be 22 00:01:13.640 --> 00:01:15.959 five to ten minutes, and I'll just explain some stuff, 23 00:01:16.239 --> 00:01:19.959 and I'm planning on putting out some video content related 24 00:01:20.000 --> 00:01:23.599 to that, right, So I'll explain the concepts behind a thing, 25 00:01:23.760 --> 00:01:26.000 and then and you know, hey, you probably want to 26 00:01:26.040 --> 00:01:28.079 do this, or you probably want to do this instead 27 00:01:28.079 --> 00:01:32.239 of that, and then do a quick video demo and 28 00:01:32.599 --> 00:01:36.480 show you what the difference is. But in the meantime, 29 00:01:36.519 --> 00:01:38.319 let's go ahead and dive in and talk about the 30 00:01:38.359 --> 00:01:43.799 situation with Rocky Mountain Ruby or sorry, with Ruby Central. 31 00:01:44.840 --> 00:01:48.519 I kind of Freudian slipped, I guess with mentioning Rocky 32 00:01:48.519 --> 00:01:50.920 Mountain Ruby. I was at Rocky Mountain Ruby a week 33 00:01:51.000 --> 00:01:52.680 or so ago. There were a number of people who 34 00:01:52.760 --> 00:01:55.400 are involved in the whole Ruby Central situation that we're there. 35 00:01:56.680 --> 00:01:59.959 I'm not going to attribute anything to anyone person, because 36 00:02:01.000 --> 00:02:03.079 I kind of got the story from a handful of 37 00:02:03.079 --> 00:02:05.480 people that are involved, and then another handful of people 38 00:02:05.519 --> 00:02:08.719 who have been following things pretty closely. And I don't 39 00:02:08.759 --> 00:02:12.319 want to represent that what I've gathered is necessarily the 40 00:02:12.400 --> 00:02:17.400 opinion or you know, any kind of statement from anybody 41 00:02:17.400 --> 00:02:21.319 who's involved, because honestly, I'm not sure if I remember 42 00:02:21.520 --> 00:02:27.120 which details came from which people, and so anyway, I 43 00:02:27.159 --> 00:02:29.680 feel like I've been able to gather more information than 44 00:02:31.520 --> 00:02:34.479 what's kind of out there at the moment, so we 45 00:02:34.520 --> 00:02:37.240 can dive into that. One other thing is is that 46 00:02:37.919 --> 00:02:41.439 if you're looking for me to take sides on, you know, 47 00:02:42.000 --> 00:02:44.319 these people did everything right and these people did everything wrong. 48 00:02:44.479 --> 00:02:46.479 I don't feel like that's the case in this case. 49 00:02:46.520 --> 00:02:51.000 I feel like both sides have made decisions that definitely. 50 00:02:50.520 --> 00:02:51.479 Could have been made better. 51 00:02:52.240 --> 00:02:55.840 And I don't think anybody comes out of this looking like, oh, well, 52 00:02:55.840 --> 00:02:59.039 we did everything right and they screwed us over. So anyway, 53 00:02:59.080 --> 00:03:01.280 I'm just gonna just kind of wanted to put that 54 00:03:01.360 --> 00:03:05.960 out there as we get into it. So anyway, so 55 00:03:06.039 --> 00:03:09.599 let me back up and give some historical information for folks. 56 00:03:10.560 --> 00:03:11.879 I know that there are a lot of people that 57 00:03:11.919 --> 00:03:14.520 are newer to the community and haven't been around for 58 00:03:15.560 --> 00:03:17.680 all of the things that we've kind of lived through 59 00:03:17.840 --> 00:03:20.599 over the last fifteen or twenty years. I've been programming 60 00:03:20.680 --> 00:03:24.240 Ruby for around twenty years, and so I've kind of 61 00:03:24.280 --> 00:03:28.159 seen a lot of the things that add up to this, 62 00:03:28.599 --> 00:03:30.599 and you know, and so I want to give that 63 00:03:30.719 --> 00:03:36.599 context as well. Essentially the situation, I'll just give a 64 00:03:36.599 --> 00:03:38.680 little bit of that, and then I'll go back historically, 65 00:03:39.159 --> 00:03:40.599 you know, so that you can kind of see where 66 00:03:40.599 --> 00:03:47.639 it's headed. But the situation is that a few weeks ago, 67 00:03:47.719 --> 00:03:50.680 maybe a month or so ago, sounds like it was 68 00:03:50.719 --> 00:03:55.840 in early September or maybe late August, ruby Central. So 69 00:03:55.879 --> 00:03:58.080 some people came out who work on some of the 70 00:03:58.080 --> 00:04:02.599 projects like ruby jumps dot org, the Ruby Gems command 71 00:04:02.599 --> 00:04:07.199 line interface, and Bundler, and they said that they had 72 00:04:07.280 --> 00:04:12.120 had their access to the repositories revoked, that the organizations 73 00:04:12.159 --> 00:04:17.040 that on GitHub that those repositories belonged to had been 74 00:04:17.079 --> 00:04:21.680 reassigned to Marty HoTT, who's the developed director of open 75 00:04:21.720 --> 00:04:27.519 source at Ruby Central. And then I guess they got 76 00:04:27.560 --> 00:04:30.000 their access back for a little bit, and then they 77 00:04:30.040 --> 00:04:37.959 had their access finally revoked. So then people were saying, well, hey, 78 00:04:38.040 --> 00:04:41.600 you're essentially taking these projects that people work on for 79 00:04:41.680 --> 00:04:45.720 the community out of their hands, and so people were 80 00:04:45.720 --> 00:04:48.160 saying it was a hostile takeover and things like that. 81 00:04:49.199 --> 00:04:51.720 I'm finding that there's a lot more context here, right So, 82 00:04:52.040 --> 00:04:56.240 like I said before, I think the reasons that Ruby 83 00:04:56.279 --> 00:04:59.560 Central's doing what it's doing are understandable, and I think 84 00:04:59.560 --> 00:05:02.120 there are which could have been much much, much much better. 85 00:05:04.879 --> 00:05:07.439 And I also understand where the contributors are coming from 86 00:05:07.480 --> 00:05:08.920 because they've been working on this stuff for a really, 87 00:05:09.000 --> 00:05:13.600 really really long time. So let's rewind way back, right, 88 00:05:13.639 --> 00:05:15.639 and let's talk about the way things worked when I 89 00:05:15.680 --> 00:05:18.639 started doing Ruby back in like two thousand and six. 90 00:05:20.120 --> 00:05:21.879 So I was working for a company that. 91 00:05:23.439 --> 00:05:26.000 I was actually running their tech support department, and we built, 92 00:05:28.040 --> 00:05:31.240 we built the infrastructure for our support teams in Rails, 93 00:05:32.079 --> 00:05:36.000 me and another guy that were running the support team. 94 00:05:36.120 --> 00:05:39.480 And back then, when you built a Ruby or Rails application, 95 00:05:41.040 --> 00:05:44.279 there was no gem file right, no bundler didn't exist, 96 00:05:44.519 --> 00:05:45.839 and so what you would do is you would do 97 00:05:45.879 --> 00:05:49.399 a gem install on your machine and it would run 98 00:05:49.439 --> 00:05:52.800 whatever version of Ruby you had on your machine. And 99 00:05:52.839 --> 00:05:56.920 there weren't these convenient switchers like RVM or OURBND, and 100 00:05:57.000 --> 00:05:59.759 so you just had to have the right version on 101 00:05:59.800 --> 00:06:02.720 your computer, have the right gems installed, and then you 102 00:06:02.759 --> 00:06:04.319 would require them and it would pull them out of 103 00:06:04.319 --> 00:06:05.439 wherever you had them installed. 104 00:06:06.120 --> 00:06:06.519 And so. 105 00:06:08.199 --> 00:06:12.399 If you had jim incompatibilities, you would get errors. 106 00:06:12.199 --> 00:06:13.480 When you ran your Ruby code. 107 00:06:14.240 --> 00:06:21.399 And as applications got more complicated, especially for Rails, applications, 108 00:06:23.240 --> 00:06:25.639 dependency management became a huge nightmare, and then when you 109 00:06:25.720 --> 00:06:29.360 upgraded from one version of Rails to another, it became 110 00:06:29.439 --> 00:06:34.040 even more of a nightmare. So when we transitioned from 111 00:06:34.199 --> 00:06:40.759 Rails two to Rails three, and Yahuta Katz and Carl Lerchie, 112 00:06:41.120 --> 00:06:43.480 I can't remember how to say his name, anyway, they 113 00:06:43.839 --> 00:06:46.680 were ya hootah did most You know, he was kind 114 00:06:46.680 --> 00:06:48.480 of the front man for a lot of the work. 115 00:06:48.519 --> 00:06:49.959 He was the one that was out there, given the 116 00:06:49.959 --> 00:06:52.839 talks and things like that, and so I kind of 117 00:06:52.879 --> 00:06:54.480 want to give him more credit, but I don't know 118 00:06:54.480 --> 00:06:56.160 how much of the work was done by either of 119 00:06:56.160 --> 00:06:59.199 those guys. And I can't remember if Tom Dale was 120 00:06:59.240 --> 00:07:00.720 involved in that or not, or if he just got 121 00:07:00.720 --> 00:07:03.240 involved later and was more of an influence in Ember, 122 00:07:04.079 --> 00:07:10.000 which is a JavaScript framework. But anyway, so they they 123 00:07:10.040 --> 00:07:12.399 did this work in the eight they had been working 124 00:07:12.480 --> 00:07:17.240 on a competitor to Rails called MERB and Rails and 125 00:07:17.240 --> 00:07:20.519 Merb decided to merge, and so they merged, and that 126 00:07:20.519 --> 00:07:23.399 that upgrade was kind of a big, big, big move. 127 00:07:24.120 --> 00:07:25.920 But a few of the things that came out of 128 00:07:25.920 --> 00:07:31.160 that were eventually we got Bler from a lot of 129 00:07:31.199 --> 00:07:35.000 that work and I think Carl and Yehuda were the 130 00:07:35.000 --> 00:07:38.920 ones that started it. For a really really long time, 131 00:07:38.959 --> 00:07:41.720 andre Arco was the one that was kind of spearheading 132 00:07:42.199 --> 00:07:45.079 the work on that, and so we got Buler from that. 133 00:07:45.360 --> 00:07:47.439 It changed a lot of things because then you could 134 00:07:47.480 --> 00:07:50.680 just put stuff into the gem file and Butler would 135 00:07:50.720 --> 00:07:55.519 figure out what dependencies you needed and it would align 136 00:07:55.560 --> 00:07:57.839 all that stuff, and then if it couldn't find compatible 137 00:07:58.639 --> 00:08:01.519 versions with everything that you've ad for, then it would 138 00:08:01.519 --> 00:08:05.040 tell you. And so anyway, that became kind of this 139 00:08:05.079 --> 00:08:09.680 critical thing. Ruby Gems the cli and ruby Gems the 140 00:08:09.759 --> 00:08:15.639 server were around before I was programming Ruby, and so 141 00:08:15.800 --> 00:08:17.720 a lot of that work was done by Eric Hodle 142 00:08:18.000 --> 00:08:21.600 and some of the other folks around there. And my 143 00:08:21.759 --> 00:08:25.319 understanding is is that for the RubyGems dot org service, 144 00:08:28.399 --> 00:08:31.639 somebody had to pay the server bills, right, and Ruby 145 00:08:31.680 --> 00:08:34.360 Central had kind of informed to run Ruby komf and 146 00:08:34.440 --> 00:08:38.320 rails comp and so it's my understanding that they just 147 00:08:38.360 --> 00:08:41.360 took that under their wing kind of formed something that 148 00:08:41.360 --> 00:08:44.559 looks like a foundation. I'm not sure if they're organized 149 00:08:44.600 --> 00:08:46.200 in the same way as kind of like the Rails 150 00:08:46.200 --> 00:08:48.360 Foundation or some of the other open source foundations like 151 00:08:48.480 --> 00:08:54.279 Linux Foundation, but ultimately they have corporate sponsors, and I 152 00:08:54.279 --> 00:09:00.600 think they were actually making money from the conferences and 153 00:09:00.879 --> 00:09:03.120 anyway they were able to pay for the infrastructure to 154 00:09:03.159 --> 00:09:07.039 run regems dot org and so you know they've hosted 155 00:09:07.039 --> 00:09:10.399 those servers and things like that. And then of course, 156 00:09:10.559 --> 00:09:14.799 you know, over the years, people have become more sophisticated 157 00:09:14.840 --> 00:09:17.120 in the way that they try and compromise people software, 158 00:09:17.159 --> 00:09:20.720 and one of them are supply chain attacks, and so 159 00:09:21.039 --> 00:09:23.159 you know, they've had to become much more sophisticated in 160 00:09:23.200 --> 00:09:27.399 the way that they handle requests or you know, posting 161 00:09:27.440 --> 00:09:29.159 of Ruby gems and things like that to make sure 162 00:09:29.200 --> 00:09:33.080 that when you pull in a gem that it's what 163 00:09:33.120 --> 00:09:35.440 you expected to be and it doesn't have any malicious 164 00:09:35.480 --> 00:09:39.440 code in it or you know, open up vulnerabilities in 165 00:09:39.440 --> 00:09:41.799 your application and things like that, and I think they 166 00:09:41.840 --> 00:09:44.039 do a pretty good job of that. I can't think 167 00:09:44.080 --> 00:09:48.519 of any major problems that you know, that have come 168 00:09:48.600 --> 00:09:51.639 from ruby gems itself, and if they have been issues, 169 00:09:51.679 --> 00:09:53.120 they've been on top of fixing those. 170 00:09:53.320 --> 00:09:53.480 Right. 171 00:09:53.559 --> 00:09:56.600 Most of the time, it's oh, we overlooked a thing 172 00:09:56.720 --> 00:09:58.759 in you know, a gem or something, right, and so 173 00:09:58.799 --> 00:09:59.879 then you get a patch. 174 00:09:59.639 --> 00:10:00.879 To ray or something like that. 175 00:10:01.240 --> 00:10:03.519 But anyway, so that's where a lot of this comes from. 176 00:10:03.559 --> 00:10:07.759 And then a few years ago, I say a few, 177 00:10:07.759 --> 00:10:09.600 but I think it was probably like ten or more 178 00:10:09.679 --> 00:10:13.559 years ago, a lot of these folks were spending quite 179 00:10:13.559 --> 00:10:15.960 a bit of time maintaining a lot of these projects 180 00:10:16.559 --> 00:10:19.799 for the Ruby community, right, so rubygms dot org and 181 00:10:20.000 --> 00:10:25.759 Bundler in particular, and so, and it's all open source software, 182 00:10:25.840 --> 00:10:28.480 and they weren't really getting paid. This was before you 183 00:10:28.480 --> 00:10:32.480 could sponsor people on GitHub, and there really weren't other 184 00:10:32.759 --> 00:10:35.960 terrific mechanisms for people to say, hey, I'm doing this 185 00:10:36.080 --> 00:10:38.039 work that benefits you. Do you want to throw me 186 00:10:38.080 --> 00:10:42.799 a few bucks? And so they founded a group called 187 00:10:42.879 --> 00:10:47.399 Ruby Together. And what Ruby Together did is it it 188 00:10:47.600 --> 00:10:51.399 collected a fund similar to Ruby Central, right where you 189 00:10:51.480 --> 00:10:54.120 have these companies that are donating to them. And then 190 00:10:54.120 --> 00:10:56.799 they were able to pay the open source maintainers at 191 00:10:56.879 --> 00:11:01.080 least something for kind of the above and beyond amount 192 00:11:01.080 --> 00:11:04.120 of time that they were spending on Bundler and ruby 193 00:11:04.200 --> 00:11:07.320 gems and RubyGems dot org so that they could provide 194 00:11:07.399 --> 00:11:10.879 us with secure, functional tools that do the job that 195 00:11:10.919 --> 00:11:11.840 we need them to do. 196 00:11:12.600 --> 00:11:14.639 And then you know, and that all made sense, right. 197 00:11:16.440 --> 00:11:18.000 It was kind of in a time where I felt 198 00:11:18.039 --> 00:11:20.879 like some of the social agendas were starting to crop up, 199 00:11:20.919 --> 00:11:23.120 and they were a little bit vocal on that. But 200 00:11:23.159 --> 00:11:25.519 for the most part, they you know, they mostly were 201 00:11:25.559 --> 00:11:29.799 just raising money for you know, for the the infrastructure 202 00:11:29.799 --> 00:11:32.919 work that they were doing, right, and so, you know, great, 203 00:11:33.320 --> 00:11:35.399 we still get all of the goodies for free. 204 00:11:35.720 --> 00:11:37.559 They're doing work that we all need done. 205 00:11:38.960 --> 00:11:41.360 You know, they're getting paid for it, which I think 206 00:11:41.440 --> 00:11:45.360 is great, and so more power to them. And so 207 00:11:45.519 --> 00:11:49.399 my understanding is about three three to five years ago, 208 00:11:51.720 --> 00:11:54.480 Ruby Central and Ruby Together figured out that they were 209 00:11:54.519 --> 00:11:58.039 basically going and asking for support from the same groups, 210 00:11:58.159 --> 00:12:00.919 from the same folks, right, because the folks that support 211 00:12:01.000 --> 00:12:04.320 Ruby Central or companies that use Ruby on a regular basis, 212 00:12:05.559 --> 00:12:09.120 you know, so Shopify and you know, base Camp and whoever, Right, 213 00:12:09.200 --> 00:12:11.799 they all run on Ruby and use the Ruby infrastructure. 214 00:12:11.799 --> 00:12:14.159 And so they were giving money to Ruby Central. But 215 00:12:14.240 --> 00:12:17.679 then a lot of the infrastructure that's supported by Ruby 216 00:12:17.720 --> 00:12:21.120 Central runs on software that's being developed by Ruby Together, 217 00:12:21.200 --> 00:12:23.320 and so they decided to merge, and so they did, 218 00:12:23.919 --> 00:12:27.759 and they merged, and so what wound up happening was 219 00:12:28.600 --> 00:12:33.519 now Butler rubygms, dot org and Rubygms are all maintained 220 00:12:33.519 --> 00:12:36.320 by Recentral, along with the. 221 00:12:36.159 --> 00:12:38.240 Conferences that they are no longer going to do. 222 00:12:38.320 --> 00:12:39.919 I don't know if they're going to still do ruby COFF, 223 00:12:40.000 --> 00:12:42.720 but they publicly announced that they are not going to 224 00:12:42.759 --> 00:12:48.039 do rails COMF so so anyway, so that's kind of 225 00:12:48.080 --> 00:12:51.240 where we wind up sitting for a while, right is, 226 00:12:53.039 --> 00:12:58.720 Ruby Central is paying the developers you know as contractors basically, 227 00:12:59.000 --> 00:13:00.919 so they're paying a lot of these people to work 228 00:13:00.960 --> 00:13:04.200 on the Ruby GM's infrastructure and the Bundler infrastructure and 229 00:13:04.279 --> 00:13:07.039 a lot of this other stuff that we use all 230 00:13:07.159 --> 00:13:13.039 the time. And Ruby Central is now responsible for all 231 00:13:13.080 --> 00:13:15.440 of this infrastructure and our supply chain to get us 232 00:13:15.480 --> 00:13:19.279 gems right. And so you can kind of see where 233 00:13:19.279 --> 00:13:23.080 we're headed with this, right So, if they have a 234 00:13:23.120 --> 00:13:30.120 responsibility for that, then they might have some liability if 235 00:13:30.320 --> 00:13:36.399 there's a supply chain attack and you know, the problems 236 00:13:36.399 --> 00:13:41.360 aren't handled properly. And so it's my understanding. And again 237 00:13:41.440 --> 00:13:43.799 this is I talked to a whole bunch of people. 238 00:13:45.080 --> 00:13:48.720 I can't really name anyone source for this. It's it's 239 00:13:48.759 --> 00:13:52.039 been gathered over a number of conversations. But my understanding 240 00:13:52.159 --> 00:13:56.519 is is that the board Ruby Central started getting legal 241 00:13:56.519 --> 00:14:01.440 advice that indicated that they could have some level of 242 00:14:01.519 --> 00:14:06.080 vulnerable or of liability if there was. 243 00:14:06.120 --> 00:14:07.840 If there was a supply chain attack. 244 00:14:08.639 --> 00:14:13.000 And the other concern was that the developers that work 245 00:14:13.039 --> 00:14:16.960 on these systems didn't really have the kinds of liability 246 00:14:17.000 --> 00:14:21.320 protections that they ought to, right, so if somebody made 247 00:14:21.360 --> 00:14:25.759 a mistake building ruby gems the CLI, and somebody else 248 00:14:25.879 --> 00:14:29.159 was able to exploit that and do a mass supply 249 00:14:29.240 --> 00:14:32.919 chain attack, they might be personally liable. And so there 250 00:14:32.960 --> 00:14:36.519 were these concerns that were coming up, but mainly, if 251 00:14:36.639 --> 00:14:41.320 Ruby Central gets sued and gets taken down, then who's 252 00:14:41.320 --> 00:14:43.200 going to run RubyGems dot org and who's going to 253 00:14:43.240 --> 00:14:45.000 do the work to protect the supply chain and things 254 00:14:45.039 --> 00:14:50.399 like that. So, and here's where I'm not going to 255 00:14:50.440 --> 00:14:53.919 represent anything that I haven't heard or don't know, but 256 00:14:54.039 --> 00:14:57.360 it's my understanding that they determined that they needed to 257 00:14:57.720 --> 00:15:03.720 amend the agreements they had with these other open source 258 00:15:03.759 --> 00:15:09.320 maintainers so that Ruby Central could protect itself in the 259 00:15:09.360 --> 00:15:15.679 case of, you know, something going really badly, and on 260 00:15:15.879 --> 00:15:22.399 the other side, provides some level of indemnification to the 261 00:15:23.720 --> 00:15:27.759 Ruby The Butler and Ruby Gems maintainers, right, so that 262 00:15:28.320 --> 00:15:32.279 if something happened and they got personally sued, that Ruby 263 00:15:32.320 --> 00:15:36.240 Central would be in a position to help protect them 264 00:15:35.919 --> 00:15:39.679 from legal jeopardy. And so the other thing is is, 265 00:15:39.799 --> 00:15:42.039 and I've seen this in other open source systems where 266 00:15:42.639 --> 00:15:47.519 if you contribute to a project, so legally under US law, 267 00:15:47.600 --> 00:15:51.960 if you write code, you own the code. And so 268 00:15:52.240 --> 00:15:54.679 usually if you're working on some kind of system that's 269 00:15:55.240 --> 00:15:59.519 out there at all, then especially if it has a license, 270 00:15:59.559 --> 00:16:02.320 it's not like MIT, right, because if it's MIT license, 271 00:16:02.600 --> 00:16:05.039 the license basically says take this and do whatever you 272 00:16:05.039 --> 00:16:07.639 want with it, right, And so then there's there's not 273 00:16:07.720 --> 00:16:11.759 really any like I can't come after you for using 274 00:16:11.799 --> 00:16:13.480 my code because it's MIT license. 275 00:16:13.720 --> 00:16:13.840 Right. 276 00:16:13.960 --> 00:16:17.159 If I license an MIT, it says explicitly in there 277 00:16:17.159 --> 00:16:18.480 you can do whatever you want with it, and so 278 00:16:19.399 --> 00:16:23.440 I'm essentially giving over my copyright protection on the code 279 00:16:23.679 --> 00:16:25.399 and allowing you to do what you want with it. 280 00:16:25.440 --> 00:16:28.360 But some of the other licenses out there don't allow that. 281 00:16:28.440 --> 00:16:30.399 And so then what happens is a lot of times 282 00:16:30.440 --> 00:16:33.960 you'll have a contributor agreement that says, if you contribute 283 00:16:34.039 --> 00:16:38.200 to our code base, then we own the code, and 284 00:16:38.360 --> 00:16:41.120 we control the license, and we're able to write, we're 285 00:16:41.159 --> 00:16:43.480 able to put it out however we want, right and 286 00:16:43.519 --> 00:16:46.600 so then they can continue to maintain it under an 287 00:16:46.600 --> 00:16:49.519 Apache license or things like that, and they don't have 288 00:16:49.559 --> 00:16:55.799 any obligation to you to you know, they don't forget 289 00:16:55.840 --> 00:16:58.480 your permission if they want to do something else with 290 00:16:58.480 --> 00:17:02.639 the project leader, and so it gives the project owner 291 00:17:02.679 --> 00:17:06.359 of flexibility. And so it's my understanding that that's kind 292 00:17:06.359 --> 00:17:08.680 of the direction that Ruby Central was looking to go to, 293 00:17:09.200 --> 00:17:11.759 where they could then have these kinds of contributor agreements 294 00:17:11.759 --> 00:17:15.799 that would allow them to operate and have a little 295 00:17:15.799 --> 00:17:20.279 more control over how rubygms, RubyGems dot org and things 296 00:17:20.319 --> 00:17:24.759 like that we were managed. But if you look at 297 00:17:24.799 --> 00:17:26.279 it from the other side, I mean, some of these 298 00:17:26.279 --> 00:17:28.079 folks have been working on these projects for more than 299 00:17:28.079 --> 00:17:31.640 ten years and have done a ton of work, and 300 00:17:31.680 --> 00:17:36.279 they've kind of operated in this arena where they didn't 301 00:17:36.359 --> 00:17:40.400 have as much oversight and they didn't have people telling 302 00:17:40.440 --> 00:17:43.720 them what they could and couldn't do, and you know, 303 00:17:43.759 --> 00:17:46.680 they felt a sense of ownership over the project, which 304 00:17:47.079 --> 00:17:52.720 you know, I think is terrific. And so Ruby Central 305 00:17:52.799 --> 00:17:55.519 coming in and saying hey, guys, we need you to 306 00:17:55.599 --> 00:18:00.119 sign these agreements and do X, y and z in 307 00:18:00.200 --> 00:18:04.400 order to continue to work on this project. And you know, 308 00:18:04.480 --> 00:18:07.000 we're going to take a more active and controlling role 309 00:18:07.200 --> 00:18:10.400 on this open source project that you've just worked on 310 00:18:10.519 --> 00:18:13.640 and contributed you know, hours and hours and years of 311 00:18:13.680 --> 00:18:16.960 your life to. Right, we're taking a level of ownership 312 00:18:17.000 --> 00:18:20.759 away from you. I totally understand these people going, whoa, whoa, 313 00:18:20.799 --> 00:18:25.720 Wait a minute, right, we don't remember signing up for this, right, 314 00:18:26.319 --> 00:18:29.799 we signed up for Hey, you know, let's fund this 315 00:18:29.880 --> 00:18:31.920 stuff in the way that it gets funded. 316 00:18:32.160 --> 00:18:32.319 Right. 317 00:18:32.839 --> 00:18:35.400 But I also can see the side of things from 318 00:18:35.480 --> 00:18:39.200 Ruby Central's angle where they're looking at it and going, 319 00:18:41.079 --> 00:18:44.880 if we own and are responsible for the code in Bundler, 320 00:18:45.519 --> 00:18:48.400 in the Ruby gmc l I and rubygms dot org, 321 00:18:49.799 --> 00:18:53.400 and something bad happens even though we didn't do it, right, 322 00:18:53.440 --> 00:18:57.359 it's it's a contributor that's here, that's contracted through us. 323 00:18:58.400 --> 00:19:02.680 We bear the brunt of that liability, and so we 324 00:19:02.759 --> 00:19:06.359 need to have certain guarantees in order to be able 325 00:19:06.400 --> 00:19:09.079 to say no, we've done everything we can, because then 326 00:19:09.119 --> 00:19:11.400 if they get sued and they say, look, you know, 327 00:19:12.079 --> 00:19:14.200 we've done we did everything we could, We followed all 328 00:19:14.200 --> 00:19:18.279 the best practices. Right, we shouldn't be held liable for 329 00:19:18.440 --> 00:19:22.960 a thing that is impossible to foresee and uh, where 330 00:19:23.000 --> 00:19:26.880 there's not really a good practice for protecting against it, right, 331 00:19:27.480 --> 00:19:29.559 then then they can they can put together a much 332 00:19:29.599 --> 00:19:32.279 more sound defense because at the end of the day, 333 00:19:32.279 --> 00:19:34.960 they can tell the court, no, we did everything we 334 00:19:34.960 --> 00:19:36.960 were supposed to do, right, and it's not it's not 335 00:19:37.359 --> 00:19:40.599 negligence or malice on our part, and so we can't 336 00:19:40.599 --> 00:19:45.920 be held liable. Right And and so I understand. I 337 00:19:46.000 --> 00:19:49.119 understand both sides. I understand the push and pull. So 338 00:19:49.920 --> 00:19:52.920 here's here's where things kind of get a little dicey 339 00:19:53.039 --> 00:19:55.799 for me on the Ruby Central side, right, because for 340 00:19:55.880 --> 00:19:59.720 the most part, I understand where Ruby Central is coming from, 341 00:19:59.799 --> 00:20:02.400 and I support them in what they were doing as 342 00:20:02.400 --> 00:20:05.519 far as their motivations and things like that. Right, I 343 00:20:06.200 --> 00:20:09.359 haven't seen any evidence that suggests that this was some 344 00:20:09.440 --> 00:20:13.319 kind of hostile takeover, that there's some ego involved, or 345 00:20:13.359 --> 00:20:16.559 that there's some kind of you know, malicious intent to 346 00:20:16.759 --> 00:20:21.200 screw over the community, or some political gamesmanship that has 347 00:20:21.240 --> 00:20:23.480 to do with these contributors. I haven't seen any evidence 348 00:20:23.480 --> 00:20:26.119 of that at all. And so for the most part, 349 00:20:26.160 --> 00:20:27.759 I think Ruby Central was just trying to do the 350 00:20:27.799 --> 00:20:29.200 right thing, and they did. 351 00:20:29.039 --> 00:20:31.079 It really really really really really really. 352 00:20:30.880 --> 00:20:36.880 Really really poorly, right, because the first thing they should 353 00:20:36.920 --> 00:20:38.480 have done is they should have been doing all of 354 00:20:38.519 --> 00:20:42.799 this in public, right. I understand that maybe they don't 355 00:20:42.799 --> 00:20:47.440 want to public publicize, Hey, we have this legal exposure, right, 356 00:20:48.599 --> 00:20:50.920 you know, if this, if any of this happens, then 357 00:20:50.960 --> 00:20:53.480 we're legally liable, and so we're trying to fix it. Hey, folks, 358 00:20:53.519 --> 00:20:55.799 don't sue us in the meantime, Right that maybe that's 359 00:20:55.839 --> 00:20:56.440 not the best. 360 00:20:56.240 --> 00:20:56.640 Way to go. 361 00:20:57.200 --> 00:20:59.960 But what they could do could have done, is they 362 00:21:00.079 --> 00:21:03.519 could have said and they could have come out and announced, right, hey, 363 00:21:04.079 --> 00:21:06.960 we are putting a new policy in place for contributors 364 00:21:08.319 --> 00:21:11.119 so that you know, so that we have these kinds 365 00:21:11.119 --> 00:21:15.440 of guarantees on the work that they do, and we're 366 00:21:15.480 --> 00:21:20.079 providing these kinds of protections for the contributors on the 367 00:21:20.119 --> 00:21:22.359 work that they do. And we're we're just trying to 368 00:21:22.440 --> 00:21:26.160 kind of button up some areas so that we can 369 00:21:26.160 --> 00:21:31.079 protect the community and that we can protect the we 370 00:21:31.119 --> 00:21:33.279 can protect rev Central, right, and that way we can 371 00:21:33.319 --> 00:21:36.759 continue to provide services, we can continue to work on 372 00:21:36.839 --> 00:21:38.799 these libraries and we can continue to give people what 373 00:21:38.880 --> 00:21:42.680 they need, right and maybe you know, not in so 374 00:21:42.759 --> 00:21:45.559 many words, tell us, you know that they're they're trying 375 00:21:45.599 --> 00:21:48.480 to they're trying to for the longevity of the of 376 00:21:48.519 --> 00:21:53.599 the system to make these changes and then acknowledge right 377 00:21:53.680 --> 00:21:57.119 that this may be painful and that the contributors are 378 00:21:57.119 --> 00:22:01.880 probably used to working under different constraints, and we're working to. 379 00:22:01.839 --> 00:22:04.440 Make sure that this is as painless as possible. Because 380 00:22:04.480 --> 00:22:06.240 then when you go in and you. 381 00:22:06.240 --> 00:22:11.720 Eventually revoke access or you know, try and get really 382 00:22:11.839 --> 00:22:14.799 you know, maybe even push twist arms a little bit 383 00:22:15.200 --> 00:22:18.240 to get them to sign these agreements, then people know 384 00:22:18.359 --> 00:22:18.960 it's coming. 385 00:22:19.440 --> 00:22:20.480 They know what's up. 386 00:22:21.039 --> 00:22:24.359 They know that the Ruby Central I keep wanting to 387 00:22:24.359 --> 00:22:26.240 say the foundation, but again I don't know if it's 388 00:22:26.319 --> 00:22:27.039 organized that way. 389 00:22:27.680 --> 00:22:28.599 But at the end of the. 390 00:22:28.640 --> 00:22:33.680 Day, right, just so that people can see this coming 391 00:22:33.759 --> 00:22:36.960 and go, oh, well, they obviously wouldn't agree to the 392 00:22:37.440 --> 00:22:40.920 you know, the terms on Ruby Central, and yeah, I'm 393 00:22:41.000 --> 00:22:45.519 frustrated on behalf of these folks, but you know, it 394 00:22:45.599 --> 00:22:48.160 was all done above board, It was all transparent. We 395 00:22:48.200 --> 00:22:50.519 all knew it was coming, right, and then they can 396 00:22:50.519 --> 00:22:52.680 come out and they can make similar announcements because these 397 00:22:52.680 --> 00:22:57.119 people are people that we all really rely on and 398 00:22:57.119 --> 00:22:59.519 in a lot of cases at least trust, right, we 399 00:22:59.559 --> 00:23:03.039 trust their code and things like that. So, you know, 400 00:23:03.079 --> 00:23:05.160 they had to know that these folks have a little 401 00:23:05.200 --> 00:23:07.759