For context, last week I wrote a post bringing to light a number of things Andre Arko had said and done (/posts/why-im-not-rushing-to-take-sides-in-the-rubygems-fiasco/) in the past as a way to provide some context. Context that might explain why any of the principal actors involved in the RubyGems maintainer crisis (summarized well up to that point by Emanuel Maiberg (https://www.404media.co/how-ruby-went-off-the-rails/)) would take such otherwise inexplicable actions and then fail to even attempt to explain them. Today, Jean shed some light on Shopify's significant investments in Ruby and Rails open-source (https://byroot.github.io/opensource/ruby/2025/10/09/dear-rubyists.html), and it actually paints a picture of corporate investment in open source done right. (Disclosure: I know and am friends with several people who work at Shopify on these teams, and unless they're all lying to me, they sure seem to prioritize their work based on what Ruby and Rails need, as opposed to what Shopify wants.) Jean went a step further by contrasting Shopify's approach with the perverse incentives at play when individuals or groups receive sponsorships to do open source. He also drew a pretty clear line of those incentives playing out based on how RubyGems and Bundler maintainers reacted to Shopify's feature submissions. Read the post, it's good.

As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what…