Skip to content
Tech News
← Back to articles

RubyGems Fracture Incident Report

read original more articles
Why This Matters

The RubyGems Fracture incident highlights the critical importance of transparent access management and communication within open-source communities, especially as they rely heavily on centralized platforms like GitHub. Understanding these events helps the tech industry and consumers recognize the need for robust security protocols and clear governance to prevent similar disruptions. This incident underscores the ongoing challenges of maintaining open collaboration while safeguarding project integrity.

Key Takeaways

By: Richard Schneeman

This document attempts to give closure to the Ruby community about the events that led to the incident, September 10-18, 2025, which I’ve named “RubyGems Fracture.”

Preamble

I joined Ruby Central’s Open Source Committee on October 22nd, 2025, after the GitHub access changes. I was adamant internally and externally from day one about performing a retrospective to try to wrap my head around the full, true picture of what happened and why.

In the pursuit of this task, I’ve spent 20+ hours interviewing and chasing up leads, easily quadrupling that time spent reviewing other artifacts such as chats and raw GitHub access logs. For any fact learned verbally, I’ve cross-referenced it with either another independent (important) account or hard evidence, such as a document or video, etc. This incident involved many people over a rather long time scale, and it was important to detangle how people perceived events from how they actually unfolded. The subject matter is deeply subjective, and multiple failed attempts at writing this doc came as a result of aiming for objectivity, for blameless representation. Therefore, those named in this report are:

Full-time employees of Ruby Central

Part-time consultants who were involved in access discussions

Anyone who made an access change from September 10th-18th, 2025

Those who have already been publicly identified in the discourse

Volunteer groups, including the Ruby Central Board and the Open Source Software (OSS) Committee, are listed, but their actions are represented as a group. Individual quotes from the OSS Committee are used without direct attribution when they represent a general consensus.

... continue reading