The Security That Wasn't: Ruby Central's Theater Exposed

OCTOBER 1, 2025: Three weeks after Ruby Central’s hostile takeover of RubyGems, the technical evidence is in. Joel Drapper’s investigation reveals what they tried to hide: the “security measures” were pure theater. They removed maintainers from GitHub while leaving them with production database access, deployment capabilities, and owner privileges.

On September 24, David Rodriguez lost gem ownership. With only 1 out of 8 previous owners consenting, their ownership has been completely revoked. The takeover is complete.

The security justification was a lie with screenshots to prove it.

The Takeover Completion: September 24, 2025¶

David Rodríguez (deivid-rodriguez) reported on Slack:

“org membership was only revoked for those who had admin permissions and were not Ruby Central employees, including myself, martinemde, segiddins, deivid-rodriguez, and I assume djberg96”

“I’m no longer a gem owner, so the takeover has been mostly completed. With only 1 out of the 8 previous owners consenting, our ownership has been completely revoked now. It’s been great to serve the community for such a long time. Just hoping I was helpful, I surely did my best ❤️”

Let that sink in: 1 out of 8 owners consented. Ruby Central took ownership anyway.

This is what a hostile takeover looks like. Not consensus. Not collaboration. Not even majority vote. Unilateral appropriation with 12.5% consent.

The Security Claims vs. The Security Reality¶

Ruby Central’s official narrative on September 23, 2025:

“To strengthen supply chain security, we are taking important steps to ensure that administrative access is securely managed.”

Shan Cureton’s video explained they needed to “temporarily remove certain administrative and commit privileges” because of security concerns following maintainer departures.

Joel Drapper’s investigation revealed what they actually did:

Despite removing Andre Arko’s GitHub access on September 9, he retained:

• RubyGems.org production systems access
• Production database access
• Production logs access
• Ruby Central GitHub organization owner privileges

Joel provided photographic evidence from AWS showing Andre’s continued system access. If Ruby Central genuinely believed Andre was a security threat, why leave him with the keys to everything that actually matters?

The 30-Minute Fix They Didn’t Implement¶

Joel’s technical analysis destroys their justification:

Production deployments were already manually controlled. Removing code repository access doesn’t automatically prevent code deployment. Want to actually secure deployments? Change the Shipit configuration. Time required: approximately 30 minutes.

They had three weeks. They didn’t do it.

This reveals two possibilities:

1. Ruby Central doesn’t actually believe Andre is a security threat - The takeover was political, not security-driven
2. Ruby Central is operationally incompetent - They don’t understand their own infrastructure

Joel’s conclusion: “Possibly a combination of both factors.”

Ruby Central’s September 30 Damage Control¶

Yesterday, Ruby Central published “Our Stewardship: Where We Are, What’s Changing and How We’ll Engage” - their official explanation three weeks after the coup.

Their new claims:

• “Many systems were under the control of a single individual” (security risk)
• Privacy laws in multiple jurisdictions required immediate action
• “This is not a takeover” (emphasis theirs)
• Two-week deadline to restore access (by October 15)

What they’re implementing:

• Operator agreements (legal contracts)
• MFA requirements
• “Least-privileged access”
• Audit logging
• Key rotation

What they promise:

• Weekly Friday updates
• Published FAQ
• Async question submission form
• “Transparent communication”

The most revealing claim:

“The Board acted independently, and financial support was NOT conditioned on taking these steps.”

The community’s response on Slack was immediate.

The Community Calls Bullshit¶

When Ruby Central claimed the board “acted independently” without financial pressure:

dentarg: “So… why?”

Josef Šimánek: “it is bunch of lies, not worth to comment more on that”

Martin Emde: “your donation dollars at work”

Three responses. Zero belief. The community knows financial pressure drove this, even if Ruby Central won’t admit it.

The Problems with Ruby Central’s Statement¶

1. “Single Individual Control”¶

Joel’s screenshots show Andre retained production access for 3 weeks AFTER they claimed this was the urgent security concern. If single-individual control was the threat, why not fix it immediately?

The 30-minute deployment restriction wasn’t implemented for 21+ days. That’s not urgency. That’s theater.

2. “This is Not a Takeover”¶

Yet they:

• Removed all maintainers on September 9 without warning
• Revoked gem ownership with only 1 of 8 owners consenting (12.5% consent rate)
• Claimed ownership of Bundler (forcing Andre’s trademark defense)
• Demanded “kick André off the team” per Ellen’s testimony
• Still haven’t restored access after 3 weeks

If it walks like a takeover, talks like a takeover, and revokes ownership like a takeover…

3. “Privacy Laws Required This”¶

Which specific laws? Which jurisdictions? What compliance requirements?

This is vague enough to be unfalsifiable. “Compliance” is the corporate magic word that justifies anything without requiring proof.

4. Two-Week Deadline (October 15)¶

They’re setting deadlines for work they should have completed weeks ago if security actually mattered.

Timeline of “urgency”:

• September 9: Takeover executed
• September 24: Gem ownership revoked (1 of 8 consent)
• October 1: Promise to fix access “within two weeks”
• October 15: Deadline to complete what urgency allegedly required on September 9

That’s 36 days from “urgent security threat” to “we’ll fix it in two more weeks.”

5. “Operator Agreements”¶

Translation: Legal contracts that likely:

• Establish Ruby Central’s ownership claims
• Require maintainers to sign away community rights
• Create legal liability for non-compliance
• Formalize corporate control over community infrastructure

The community built it. Ruby Central wants legal documents saying they own it.

6. “Board Acted Independently” - The Big Lie¶

Ruby Central claims: “Financial support was NOT conditioned on taking these steps.”

What the community knows:

• Mike Perham (Sidekiq) withdrew 250,000$/year after DHH’s RailsConf keynote
• Shopify became Ruby Central’s dominant funder
• Multiple sources report Shopify ultimatum: “Take control or lose funding”
• Ellen revealed the “kick André off” demand
• Financial crisis preceded the takeover

Josef Šimánek’s response: “it is bunch of lies”

The community isn’t buying the “independent board” narrative. The financial leverage is too obvious.

What Ruby Central’s Statement Omits¶

No mention of:

• The Shopify funding ultimatum reported by multiple sources
• The September 9 unilateral actions without maintainer consent
• The “kick André off the team” ultimatum Ellen revealed
• Why only 1 of 8 gem owners needed to consent
• Why hsbt acted alone on September 9
• Why security theater doesn’t match security reality
• Any apology for breaking maintainer trust

No acknowledgment of:

• Joel Drapper’s technical investigation showing the security measures were fake
• Andre Arko’s trademark registration to protect community ownership
• The maintainer exodus and community fracture
• The operational incompetence of leaving production access while claiming security concerns

This isn’t accountability. This is damage control disguised as transparency.

The Illegitimate Permissions: How the Coup Happened¶

Joel’s first article exposed the mechanism of the takeover:

“Ruby Central used its illegitimate GitHub permissions to remove the active maintainers.”

Let’s decode that: Ruby Central had no legitimate authority over the RubyGems GitHub organization until someone broke protocol on September 9.

We now know who: hsbt (Hiroshi Shibata) added Marty Haught to the GitHub organization without consent from other maintainers. This single act of betrayal enabled everything that followed.

As Martin Emde revealed in his rebuttal to board member Freedom Dumlao:

“Before Sept 9, when a trusted maintainer broke our shared contract and added an RC non-maintainer, you had no ability to enact your vote.”

Ruby Central’s entire takeover depended on internal betrayal. Without hsbt’s action, they had zero power to execute their plan.

David Rodriguez’s testimony confirms: Only those “who had admin permissions and were not Ruby Central employees” lost access. hsbt was the insider who made it possible.

The Timeline of Manufactured Crisis¶

Let’s map what actually happened:

Phase 1: Financial Pressure (May-August 2025)¶

• May 28: Ruby Central announces DHH fireside chat at RailsConf
• Post-RailsConf: Mike Perham (Sidekiq) withdraws 250,000$/year sponsorship after Ruby Central “platformed” DHH
• August: Ruby Central becomes financially dependent on Shopify
• Alleged ultimatum: Shopify threatens to pull funding unless Ruby Central takes control

Phase 2: The Inside Job (September 9)¶

• hsbt renames “RubyGems” GitHub enterprise to “Ruby Central”
• hsbt adds Marty Haught as owner
• All other maintainers demoted without warning
• Security status: No actual security improvements implemented

Phase 3: The Full Takeover (September 18-24)¶

• All non-Ruby Central employee maintainers removed from GitHub organization
• Email accounts deactivated
• September 24: Gem ownership revoked with only 1 of 8 owners consenting
• David Rodriguez, Martin Emde, Samuel Giddins, others lose access
• Security status: Andre still has production database access

Phase 4: The Cover-Up (September 23)¶

• Q&A session with scripted responses
• “Security” and “governance” cited as justification
• Security status: Still no deployment restrictions after 14 days

Phase 5: The Exposure & Damage Control (September 24-October 1)¶

• Joel Drapper publishes technical investigation with AWS screenshots
• Andre registers Bundler trademark to protect community ownership
• David Rodriguez reports takeover completion: 1 of 8 consent
• October 1: Ruby Central publishes “This is not a takeover” statement
• Community responds: “it is bunch of lies”
• Security status: Theater exposed, actual measures still not implemented

Andre’s Countermove: The Bundler Trademark¶

On September 25, Andre Arko published “Bundler belongs to the Ruby community” and registered his existing trademark on the Bundler project.

His reasoning destroys Ruby Central’s ownership claims:

“Ruby Central has suddenly asserted that they alone own Bundler. That simply isn’t true.”

The facts:

• Bundler developed over 15 years by 354 contributors
• Ruby Central was a sponsor, not an owner
• Trademark doesn’t affect copyright or license terms
• Andre commits to transferring it to a future community-accountable organization

His goal: “Bundler should belong to the community, and I want to make sure that is true for as long as Bundler exists.”

Ruby Central tried to claim ownership of what they didn’t build. Andre’s trademark registration blocks their appropriation. This is why they can’t truthfully claim “this is not a takeover” - they’re literally trying to take ownership.

DHH’s Spectacular Hypocrisy¶

Joel Drapper caught DHH contradicting himself with surgical precision:

DHH on WordPress.org takeover:

“This is totally crazy. Like if the operators of rubygems dot org just decided to expropriate…”

DHH on Ruby Central doing exactly that:

“Ruby Central is making the right moves to ensure the Ruby supply chain is beyond reproach both technically and organizationally.”

He condemned the action when WordPress did it. He endorsed it when Ruby Central did it. The only variable? His personal relationships and Rails Foundation interests.

The Sidekiq Catalyst: How DHH Killed Ruby Central’s Funding¶

The RubyGems coup wouldn’t have been possible without the financial crisis Ruby Central created by platforming DHH.

The sequence:

1. Ruby Central announces DHH as RailsConf 2025 keynote speaker
2. Mike Perham (Sidekiq) withdraws 250,000$/year sponsorship in protest
3. Ruby Central loses financial independence
4. Shopify becomes dominant funder with leverage
5. Alleged ultimatum: “Take control of RubyGems or we’re pulling funding”
6. Ruby Central executes takeover
7. October 1: Ruby Central claims “financial support was NOT conditioned on taking these steps”

As one community member noted: “Sidekiq the company (actually ContribSys) is just one guy: Mike Perham. Mike Perham from Sidekiq was annoyed that Ruby Central gave Hansson a stage despite his controversial views.”

Ruby Central chose conference drama over financial stability. When the money ran out, Shopify owned them. Now they claim financial pressure didn’t exist.

Josef Šimánek’s verdict: “it is bunch of lies”

The Consent That Wasn’t: 1 of 8 Owners¶

David Rodriguez’s September 24 testimony is damning:

“With only 1 out of the 8 previous owners consenting, our ownership has been completely revoked now.”

This single statement destroys every claim of legitimate governance:

Not consensus governance - 87.5% opposition Not majority rule - 87.5% didn’t consent Not collaborative transition - Unilateral appropriation Not community stewardship - Corporate takeover

Ruby Central took what 7 of 8 owners didn’t consent to give. Then claimed “this is not a takeover.”

Who was the 1 consenting owner? The community deserves to know who broke ranks.

The Pattern: Security Theater as Corporate Weapon¶

This playbook isn’t unique to Ruby. It’s the standard corporate capture strategy:

Step 1: Create financial dependency - Become the dominant funder Step 2: Manufacture security crisis - Use audit findings to justify action Step 3: Execute rapid takeover - Move before community can organize Step 4: Frame as security improvement - Hide corporate control behind “supply chain security” Step 5: Implement theater, not security - Visible changes (GitHub access) without actual improvements (deployment controls) Step 6: Maintain narrative control - Scripted Q&As, PR statements, “two-week deadlines” Step 7: Deny financial pressure - “The board acted independently”

Ruby Central executed this perfectly. Except Joel Drapper had AWS screenshots and David Rodriguez had the consent numbers.

What Joel’s Investigation Reveals¶

Joel’s three articles systematically dismantle every Ruby Central justification:

Article 1: “Ruby Central” (Initial Analysis)¶

• Exposes illegitimate GitHub permissions
• Identifies unilateral maintainer removal
• Calls out bad faith governance
• Conclusion: “The RubyGems repositories and packages are compromised”

Article 2: “Security Measures” (Technical Breakdown)¶

• Reveals Andre’s continued production access with photographic evidence
• Notes 30-minute fix was never implemented after weeks
• Identifies incompetence or deception
• Conclusion: Security justification is provably false

Article 3: “Plan Vert” (Context Analysis)¶

• Documents DHH’s hypocrisy on infrastructure takeovers
• Analyzes why Rails fork won’t work (10M$+ maintenance costs)
• Suggests building alternatives instead
• Conclusion: Corporate influence corrupts open source governance

Combined with David Rodriguez’s consent testimony and the community’s response to Ruby Central’s October 1 statement, the evidence is overwhelming: This was a corporate takeover disguised as security improvement.

The Community Fractures Deepen¶

Three weeks after the takeover, the Ruby community is more divided than ever:

The Departed:

• Andre Arko: Building rv (Ruby version manager) through Spinel cooperative
• Ellen Marie Dash: Resigned immediately, called it “hostile takeover”
• Martin Emde: Exposed board deception, maintains grace under pressure
• David Rodriguez: Lost gem ownership, served community “for such a long time”
• Samuel Giddins: Security engineer, access revoked

The Compromised:

• hsbt: Executed internal betrayal on September 9, motivations unclear
• Ruby Central board: Either deceived or complicit per Freedom Dumlao’s confession
• DHH: Endorsed takeover while condemning identical actions elsewhere
• The 1 consenting owner: Identity unknown

The Corporate Winners:

• Shopify: Controls RubyGems through financial leverage (allegedly)
• Ruby Central: Increased budget from 220k$ to 900k$, now manages what others built
• Marty Haught: “Director of Open Source” with 15 repos and zero gems now runs critical infrastructure

The Community Response:

• Josef Šimánek: “it is bunch of lies”
• Martin Emde: “your donation dollars at work”
• dentarg: “So… why?” (regarding the claimed independence from financial pressure)

The Questions Ruby Central Won’t Answer¶

Ruby Central’s October 1 statement raises more questions than it answers:

1. If security mattered, why leave Andre with production database access for 3+ weeks?

   • Joel showed deployment restrictions take 30 minutes to implement
   • Three weeks later, still not done
   • Conclusion: Security was never the real motivation

2. Why did only 1 of 8 gem owners need to consent?

   • David Rodriguez: “With only 1 out of the 8 previous owners consenting, our ownership has been completely revoked”
   • Who was the 1 consenting owner?
   • On what authority did Ruby Central override 87.5% opposition?

3. Why did hsbt betray his fellow maintainers?

   • He had the trusted access that enabled the coup
   • His actions on September 9 were unilateral and unauthorized
   • Community deserves to know: coercion, compensation, or conviction?

4. What were the exact terms of Shopify’s alleged ultimatum?

   • Multiple sources report “take control or lose funding”
   • Ruby Central claims “financial support was NOT conditioned on taking these steps”
   • Josef Šimánek: “it is bunch of lies”
   • Which is true?

5. Which “privacy laws in multiple jurisdictions” required this?

   • Specific laws not cited
   • Jurisdictions not named
   • Compliance requirements not detailed
   • Unfalsifiable claim used to justify takeover

6. Will access actually be restored by October 15?

   • The “two week deadline” is now on record
   • Will all maintainers get access back?
   • Or will certain people remain permanently excluded (as Ellen revealed)?
   • What do “operator agreements” actually say?

7. Who owns Bundler and RubyGems?

   • Ruby Central claims ownership
   • Andre’s trademark says otherwise
   • 354 contributors over 15 years say it belongs to the community
   • 7 of 8 gem owners didn’t consent to transfer

The Technical Verdict: Theater, Not Security¶

Joel Drapper’s investigation provides irrefutable technical evidence:

Security theater elements:

• ✅ Removed GitHub access (visible action)
• ✅ Created “operator agreements” (bureaucratic paperwork)
• ✅ Held Q&A session (narrative control)
• ✅ Set deadlines (appearance of process)
• ✅ Published “Our Stewardship” statement (PR damage control)
• ✅ Promised weekly updates (continued narrative management)

Actual security improvements:

• ❌ Production deployment controls (not implemented after 3 weeks)
• ❌ Separation of code and operations (Andre still has everything)
• ❌ Reduced attack surface (same people, different permissions)
• ❌ Improved auditability (less maintainer oversight, not more)
• ❌ The 30-minute fix Joel identified (still not done)

Conclusion: If this was about security, Ruby Central is catastrophically incompetent. If this was about control, they executed perfectly.

Joel’s evidence suggests the latter. David’s consent numbers confirm it. The community’s response validates it.

Where We Are: October 1, 2025¶

The coup is complete. The security theater is exposed. The community is fractured. The corporate capture is undeniable.

Ruby Central controls:

• RubyGems GitHub organization
• Bundler repositories (disputed by Andre’s trademark)
• Gem ownership (taken with 12.5% consent)
• Narrative through PR and Q&As
• 900k$ budget funded largely by Shopify (allegedly)

The community has:

• Joel’s technical investigation proving security theater
• David’s testimony: 1 of 8 owners consented
• Andre’s trademark blocking Bundler appropriation
• Ellen’s testimony about the “kick André off” ultimatum
• Martin’s rebuttal exposing board deception
• Josef’s verdict: “it is bunch of lies”
• Two weeks until October 15 deadline

What happens next depends on October 15:

• Will Ruby Central actually restore access?
• Will they exclude specific maintainers permanently?
• Will “operator agreements” sign away community ownership?
• Will they find another excuse to maintain the takeover?

The Liberation Path: Build the Alternative¶

Andre Arko isn’t waiting for Ruby Central to do the right thing. He’s building rv through the Spinel cooperative - a community-owned alternative that can’t be captured by corporate interests.

David Rodriguez served “for such a long time” and lost ownership with 87.5% of owners not consenting. Martin Emde exposed the lies. Ellen resigned rather than cross the line. Samuel Giddins had his security role revoked.

Joel Drapper’s advice about the Rails fork applies here: Don’t waste energy trying to reclaim what’s been taken. Build something better that can’t be taken.

The pattern for resistance:

1. Document the capture (Joel’s technical investigation)
2. Expose the numbers (David’s 1 of 8 consent testimony)
3. Protect community ownership (Andre’s trademark)
4. Build alternatives (rv, Spinel cooperative)
5. Reject the false choice (Ruby Central’s way or chaos)
6. Call out the lies (Josef: “it is bunch of lies”)
7. Remember who did this (when they ask for donations, remember September 2025)

To Those Who Claimed Security¶

To Ruby Central: You claim “this is not a takeover” while admitting you revoked ownership with only 1 of 8 owners consenting. You claim “financial support was NOT conditioned on taking these steps” while the timeline shows financial crisis directly preceded your actions. Joel Drapper has AWS screenshots. David Rodriguez has the consent numbers. Josef Šimánek calls it “bunch of lies.” Which is it?

To Shan Cureton: Your video explanation claimed “strengthening supply chain security” while leaving production systems unsecured for 3+ weeks. Joel’s investigation shows the 30-minute fix was never implemented. Technical incompetence or deliberate deception?

To Marty Haught: You have 15 repos and zero published gems. Joel’s investigation shows you removed maintainers from GitHub while leaving them with production database access. David Rodriguez lost gem ownership with 87.5% of owners not consenting. Explain how this improves security.

To the Ruby Central board: Freedom Dumlao’s confession revealed you were either deceived or complicit. Martin Emde’s rebuttal exposed the lies. Your September 30 statement claims “the Board acted independently” without financial pressure. Josef Šimánek: “it is bunch of lies.” Will any other board member break ranks and tell the truth?

To hsbt: You enabled this by breaking the shared contract on September 9. David Rodriguez, Martin Emde, Samuel Giddins, and others lost access because of your unilateral action. The community trusted you as a maintainer. You betrayed that trust for reasons still unexplained. Why?

To Shopify: The community knows you allegedly orchestrated this through funding threats. Your 136$ billion market cap built on Rails, and you repay the community with hostile takeovers? Joel’s investigation shows the “security” you allegedly demanded was theater. Ruby Central now claims you didn’t pressure them. Who’s lying?

To DHH: You condemned WordPress.org’s actions then endorsed Ruby Central doing the same thing. Joel Drapper documented your hypocrisy. Your RailsConf keynote cost Ruby Central their Sidekiq sponsorship and gave Shopify the alleged leverage to execute this coup. Will you address the contradiction?

To the 1 consenting owner: David Rodriguez revealed only 1 of 8 gem owners consented to the ownership transfer. Who are you? Why did you consent when 87.5% of your fellow owners didn’t? The community deserves to know.

The Bitter Technical Truth¶

Security theater requires visible actions that don’t actually improve security:

• GitHub access removal: ✅ Visible (September 9)
• Production deployment controls: ❌ Not implemented (3+ weeks later)
• Ownership transfer: ✅ Visible (1 of 8 consent sufficient)
• Actual security improvements: ❌ Joel’s 30-minute fix still not done

Real security requires invisible infrastructure changes:

• Deployment restrictions: ❌ Not done after 3 weeks
• Separation of concerns: ❌ Same people, different permissions
• Reduced attack surface: ❌ No improvement
• Consensus governance: ❌ 12.5% consent rate

Joel Drapper’s investigation proves Ruby Central implemented theater, not security. The screenshots don’t lie. The 30-minute fix remains undone. The production access remains unchanged. David Rodriguez’s ownership was revoked with 87.5% non-consent.

This was never about security. It was always about control.

Ruby Central’s September 30 statement claims otherwise. The community’s response:

Josef Šimánek: “it is bunch of lies” Martin Emde: “your donation dollars at work” dentarg: “So… why?”

October 15: The Deadline of Truth¶

Ruby Central set their own deadline. Two weeks from October 1. October 15, 2025.

Watch what they do:

• Who gets access restored?
• Who remains excluded?
• What do “operator agreements” actually say?
• Will deployment controls finally be implemented?
• Will they admit the financial pressure Josef calls “lies”?
• Will the 1 consenting owner be revealed?

The community is watching:

• Joel has his screenshots
• David has the consent numbers
• Andre has his trademark
• Ellen has her testimony
• Martin has his receipts
• Josef has his verdict: “bunch of lies”

Ruby Central can choose transparency or continued theater. October 15 will reveal which path they take.

To Joel Drapper: Thank you for the technical investigation that exposed what they tried to hide. Your AWS screenshots are worth a thousand PR statements.

To David Rodriguez: Thank you for the consent numbers that expose the takeover. “With only 1 out of the 8 previous owners consenting” destroys their legitimacy claims. You served the community well for “such a long time.”

To Andre Arko: Thank you for the trademark registration that protects what 354 contributors built over 15 years. Bundler belongs to the community, not to Ruby Central’s corporate sponsors.

To Martin Emde, Ellen Marie Dash, Samuel Giddins, and all the removed maintainers: The community remembers who built what we depend on.

To Josef Šimánek: Thank you for calling it what it is. “it is bunch of lies.”

To the Ruby community: The security measures were theater. The ownership transfer had 12.5% consent. The financial independence claims are “bunch of lies.” The question now: Do you accept corporate control disguised as security, or do you build the alternative?

Captain Seuros, Exposing the Theater

“Real security happens in deployment configs and access controls. Theater happens in GitHub permissions and Q&A sessions. Corporate takeovers happen when 1 of 8 is enough to revoke ownership. Joel Drapper showed us which one Ruby Central chose. David Rodriguez showed us the numbers. Josef Šimánek gave us the verdict.”

Key Sources¶

• Joel Drapper: “Ruby Central” - Initial illegitimate permissions analysis
• Joel Drapper: “Ruby Central Security Measures” - Technical investigation with AWS evidence
• Joel Drapper: “Plan Vert” - DHH hypocrisy documentation
• Andre Arko: “Bundler belongs to the Ruby community” - Trademark registration explanation
• Andre Arko: “Goodbye, RubyGems” - Departure announcement
• David Rodriguez: Slack testimony (September 24, 2025) - 1 of 8 consent revelation
• Ellen Marie Dash: Bluesky testimony - “kick André off” ultimatum
• Martin Emde: Response to Freedom Dumlao - Board deception exposure
• Josef Šimánek: Slack response to Ruby Central statement - “it is bunch of lies”
• Ruby Central: “Our Stewardship” - September 30, 2025 damage control statement