Did he or did he not log in to the AWS root account after losing his own credentials and change the root password? I don't need paragraphs of explication following that. Seems simple!
It’s telling that you can write multiple paragraphs claiming the moon is made of cheese while expecting others to communicate only in brief, misleading soundbites.
https://en.wikipedia.org/wiki/Loaded_question
Changing passwords was the responsible course of action to protect Ruby users in light of the attack. Maintainers should act in the interest of the Ruby community, not in favor of usurpers with a vendetta.
Here's what I think: people are starting from a sympathetic principle (independent community-minded maintainers are better that corporations) and working their way back to what they've decided must have happened. The person we're talking about here tried to (quietly!) monetize the server logs for RubyGems. Don't even try to play the "that's what RubyCentral says" card --- they published the email.
The world doesn't always line up with the most sympathetic principles.
Shopify stole RubyGems from the maintainers, do you deny it? They tried to do so in secret, keeping the maintainers and the larger Ruby community in the dark. Their claim that the access revocations were a mistake was a blatant lie. Moreover, they spun even more conspicuous falsehoods in response to the public backlash.
When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror.
And hey, since you imply that loaded questions aren't fallacious, tell me: have you stopped beating your wife? It's a "simple question," just answer yes or no.
These aren't insinuations; they're direct factual claims. They're well-founded and they're either true or they're not. No, you can't just jazz-hands your way through this.
When you twist protective measures against ongoing theft or shitty proposals that went nowhere into a nefarious conspiracy to justify the theft of critical Ruby infrastructure, it’s time to take a hard look in the mirror.
What are you trying to achieve here, bringing up debunked insinuations over and over and over again? And haha no, going over every cherry-picked fact and half-truth you explicitly stated doesn’t prove you aren’t making insinuations.
> insinuate: to impart or suggest in an artful or indirect way
https://www.merriam-webster.com/dictionary/insinuated
Note the word "indirect."
Now, are you using that to justify the hostile takeover of critical infrastructure to the entire Ruby community? I'm baffled. RC did a *hostile takeover*. How many times do I have to repeat this?
And why are you ignoring that RC did a hostile takeover of the repos? Again, RC stole the repos. What do you think of that?
I don't know what happened with "the repos", is why I haven't offered an opinion about it. I have a professional interest in stories about people gaining unauthorized access to accounts. I assure you, the law doesn't weigh one party's transgression against the other the way you suggest it should.
And you know what? I think you're right! What Andre did could constitute a crime. Any serious organization would lawyer up and go after him... right? RIGHT?
What sort of monetisation?
Asking because there's a huge potential range of options there, from pretty innocuous stuff through to downright evil. :(
To me that seems like a good idea, not like a betrayal of trust as some people have been making out.
Personally I also think the monetization proposal was silly, but that was in August and Ruby Central rejected it.
He logged into the root account because he thought he was on call and that someone was taking over Ruby Central, so he reacted in real time. With the obvious chaos and incompetence in Ruby Central and the ill defined takeover that does not seem far fetched.
What exactly would he have gained by openly changing the root account for malicious reasons? He knows he would have been found out. It is not even a hack.
The HN commentariat is really shocking me here, because everyone in the professional space that I talk to about this thinks this is obvious and takes the same position.
I won't follow the thought from there, but maybe you see where I'm going...