Rubygems.org AWS Root Access Event – September 2025

Re:Rubygems.org AWS Root Access Event – September 2025 by busterarm on Thursday October 09, 2025 @02:44PM (#45531500)

Props to Ruby Central for taking all of the smears and reputational damage on the chin silently while they mitigated an actual security incident, made absolutely sure and wrote up a proper post-mortem. All of that in line with their original statement that their actions taken were in the interest of security/integrity of their platform.

If there's any evidence that you need to know who the proper stewards of Ruby's gems are, it's this.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by xaxaxa123 on Thursday October 09, 2025 @04:16PM (#45532548)

odd timing for such an incident..

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by busterarm on Thursday October 09, 2025 @04:22PM (#45532632)

Not really. Someone abusing their access after being removed is exactly when such events occur.

Your post suggests conspiratorial thinking when there shouldn't be.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by xaxaxa123 on Thursday October 09, 2025 @04:45PM (#45532869)

my post suggests critical thinking when there should be..your post is just defamatory. all of this looks like a "problem, action, solution" scheme. what was the takeover then, a honest and transparent move by RC? you must be kidding. looked pretty much conspiratorial.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by software_writer on Thursday October 09, 2025 @02:47PM (#45531537)

100%

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by Mystery-Machine on Thursday October 09, 2025 @04:19PM (#45532588)

An entity that promised security had a security incident due of their incompetence to properly secure their production environment root access?

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by busterarm on Thursday October 09, 2025 @04:27PM (#45532675)

If somebody is going to abuse their accidentally-retained access after being removed from my organization, than the incompetence was in having that person in my organization in the first place. It turns out they were perfectly justified in removing him!

First of all, it's criminal, and second of all, it absolutely lights a torch to any credibility they have. I expect people don't want to become unhireable.

I've had access/credentials to organizations that I've left and never abused them even once.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by blibble on Thursday October 09, 2025 @05:52PM (#45533485)

it's not that clear cut, because there is no "rubygems company" or clear ownership of any of this stuff

it would be quite easy to argue that ruby central had never had a right to remove these people at all

> I've had access/credentials to organizations that I've left and never abused them even once.

yes, likewise

and if I was Andre I wouldn't have even have ATTEMPTED to do this, as it looks terrible regardless of the eventual legal determination

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by queenkjuul on Thursday October 09, 2025 @04:23PM (#45532643)

I mean I'd much rather it be people who remember to rotate their passwords after firing high profile staff

[ Parent | on HN ]