Summarized using AI

Evolution of Rails within RubyGems.org

Samuel Giddins and Nick Quaranto • July 08, 2025 • Philadelphia, PA • Talk

Introduction

The talk, given by Samuel Giddins and Nick Quaranto at RailsConf 2025, explores the evolution of Rails within RubyGems.org, a central open source service for the Ruby community. As a 16-year-old Rails application that serves as the backbone for distributing Ruby gems, RubyGems.org offers insights into the changing landscape of developing, deploying, and maintaining large-scale Ruby on Rails applications.

Key Points Discussed

  • Historical Context & Origin:

    • RubyGems.org began as gemcutter.org in 2009 as a community effort to provide a reliable, modern gem hosting service.
    • The site has grown to host over 185,000 gems and handle 10 billion downloads monthly.
  • Longevity of Rails Apps:

    • The application demonstrates that Rails apps can last, scale, and remain sustainable over many years.
    • Originally started on Rails 2, it is now on Rails 8, showing consistent upgrades and technical debt management.
  • Lessons from 16 Years of Development:

    • Core app elements like business logic, APIs, and database design have remained stable, while deployment, front-end frameworks, and operational practices evolved.
    • Early principles such as providing a useful API, community enhancements, and ease of use remained central throughout its evolution.
  • Front-End Evolution:

    • The UI evolved through design trends (gradients, flat design, dark mode) and minimal frontend frameworks (mainly jQuery over time).
    • Screenshots from the past highlight how the site and tooling matured alongside the Ruby ecosystem.
  • Challenges & Burnout in Open Source:

    • Speakers highlighted sustainability issues, emotional labor, burnout, and the need for financial support in open source project maintenance.
    • Solutions include paying maintainers, setting boundaries, facilitating community contribution, and fostering a welcoming environment.
  • Security and Compliance:

    • Security remains a constant challenge as a high-profile public service with a complex attack surface.
    • Past incidents were shared, including vulnerability responses and the implementation of bug bounties, automated scanning, and signing systems (e.g., SIGstore client).
    • Focus on provenance and trust to ensure that users are installing authentic gems, and ongoing improvement through policies and infrastructure automation.
  • Operational and Deployment Changes:

    • Transitioned from ad-hoc deployments and manual server management to containerization, infrastructure-as-code, and modern observability.
    • Improvements like an admin panel, PagerDuty rotation, and automated policies reduced operational load and stress.
  • Community Growth:

    • Contributions expanded from a small founding team to over 500 contributors.
    • Community engagement at events and through hackspaces is encouraged, and multiple roles (code, docs, design, funding) are essential.
  • Future Roadmap:

    • Initiatives include a gem content browser, diff viewer, vulnerability advisory database, and continued UI/UX improvements.
    • Emphasis that Rails as a framework continues to support expanding goals without being a limiting factor.

Conclusion & Takeaways

  • RubyGems.org’s journey underscores that with intentional choices, community support, and modern practices, Rails applications can be robust and persistent.
  • Sustainability and security remain ongoing priorities, requiring continued community involvement, funding, and innovation.
  • The community is encouraged to contribute in any capacity, ensuring the service’s longevity and impact for future Ruby developers.

Evolution of Rails within RubyGems.org
Samuel Giddins and Nick Quaranto • Philadelphia, PA • Talk

Date: July 08, 2025
Published: July 23, 2025
Announced: unknown

As a 16 year old open source Rails app, Rubygems.org can tell a story of how building and maintaining a Rails app has changed over the years. Join us as we progress from its creation in 2009 until today, exploring how things have changed and what we've learned. We dig into deploying, handling gem dependencies, background processing, web servers, security, and the frontend approaches. We'll wrap up with our thoughts on the future of security and compliance.

RailsConf 2025

00:00:20.400 discovered their new favorite cheese steak place, uh, show of hands if you
00:00:25.680 ordered it with Whiz for lunch and the rest of you did it wrong. Great.
00:00:32.160 Um, we're here today to talk about the evolution of Rails within Rubygeems.org.
00:00:41.200 So, joining me on this stage is a man
00:00:46.399 who is going to crush it today, uh, Nick Quiranto,
00:00:52.800 who is the original author of gem cutter.org and the site now known as
00:00:58.079 rubygeems.org. or uh and the director of platform engineering at Wistia. And if
00:01:04.080 you have any questions about sailing, I advise you to ask Nick about them.
00:01:10.159 Okay. Uh with me is uh Sam Giddens. He is the uh maintainer and security lead
00:01:15.680 for Bundler Ruby Gems and Rubygeems.org. Uh he is working with Ruby Central to
00:01:21.840 make all of that happen. And you could probably ask him about Bellatro and he'll give you a lot of good tips. Uh
00:01:27.439 he's my coach quite honestly. Uh we thought it'd be really helpful to go through and talk like what does
00:01:34.079 Rubygeems.org do if you're newer to the community and to like kind of set the stage for everyone. Uh what so what does
00:01:40.960 it do? Uh we really feel like this is the beating heart of Ruby and Rails. It's the central place where people get
00:01:47.040 their Ruby code to run and uh it does a bunch of little things that we feel are important too. Uh the big one is it
00:01:54.960 hosts every public facing gem you've ever downloaded with bundle install. Today it's over 185,000 different
00:02:01.680 packages and we feel that's really incredible. Uh we handle 10 billion
00:02:06.799 downloads per month. That's an imaginable amount of time spent staring at your terminal and taking coffee
00:02:13.120 breaks hopefully while you're waiting for your bundle and gem installs to run. Uh we provide the API that makes gem
00:02:20.480 push work. So when you want to release a gem and package it up, you send it off to us and that simple REST API powers
00:02:28.480 the Ruby uh gem ecosystem. And uh yes, of course, it's easier than explaining
00:02:33.760 your dependencies to your manager. Uh we keep your gems secure. And this is a
00:02:39.280 thing that uh we're going to cover even more of today. Uh thinking about who has access to push to a gem. We scan gems.
00:02:46.879 Uh when you run bundle update, we make sure that that works. And this is a truly huge part piece of the Ruby gems
00:02:54.879 project today. And of course, it's the central source of truth. If it's not in Ruby gems, like where is it? And I think
00:03:02.000 the curious piece is that this is not where just the good gems are. We have a lot of bad ones, too. And uh you'll hear
00:03:09.280 about some of that today. And you know, just like we host bad gems, uh I also host bad puns. So I
00:03:17.200 don't apologize. Um, so today what what we sort of want you to come away with is
00:03:25.200 uh a little bit of what it like the story behind rubygeems.org. It's uh in
00:03:32.080 addition to being like this important part of everyone's life as a Ruby
00:03:37.519 developer, it's also a 16-year-old Rails app and it's entirely open source. And
00:03:45.360 uh you know that's a pretty cool thing to be able to to talk about.
00:03:51.440 Now I think the big takeaway is we're going to talk about a lot of history. A
00:03:57.360 if you can imagine a lot has changed in the past 15 years. But a lot of the
00:04:03.120 changes that we're going to cover, they're not just about
00:04:08.319 Rails changes or changes in Ruby. They're a lot about how we've changed how we build web apps over that time
00:04:15.840 period. I mean, believe it or not, even how we build Java web apps has changed.
00:04:25.440 So, who who here has ever been asked the question like,
00:04:31.600 well, will Rails be able to this, that,
00:04:36.880 or the other thing? Um, we're all here. Can I I'm going to pose this question to
00:04:43.440 you. Like, will Rails scale? Will Rails work? Will Rails last? And I want you
00:04:49.199 all to answer together. Yes. Oh, come on. Some enthusiasm.
00:04:54.800 Yes. There. Thank you. Yeah. Rails apps can last. They can
00:05:00.800 scale. They can be sustainable. Rubygeems.org is one of those Rails
00:05:05.840 apps. Um there are others that we all use on a regular basis as well. Um Rails
00:05:14.000 apps can last they can last 15 years.
00:05:20.080 And with Rails it's really been possible to build enduring software that will stand the test of time and that's pretty
00:05:27.360 impressive regardless of what language we're talking about. So rubygeems.org today is it's it's a
00:05:35.600 Rails app. Rails 8, Ruby 3.4.4, the latest bundler release, the latest Ruby
00:05:41.120 gems release. It's it's a modern Rails app that's up to date now. But how did
00:05:47.280 we get to this point? I can guarantee you we didn't start running Rails 8. Um
00:05:53.280 I'm pretty sure it started on Rails 2. Yeah, Rails 2. Um
00:05:58.479 it's old. So along the way, we've we've learned a
00:06:04.080 lot of things that haven't changed with the app.
00:06:09.360 You know, if you if you build a good app, like your your database is going to last, well factored business logic's
00:06:16.800 going to last. Um good APIs are going to last. And you know the frustration of being a human
00:06:23.759 who's like maintaining something and talking with other humans that that's
00:06:28.800 definitely lasted and along with that a lot of stuff has
00:06:34.639 changed. Uh we've gone through how many different JavaScript frameworks of the
00:06:40.319 week to build frontends. We've changed how we deploy our apps how
00:06:45.919 many different times. We've changed like what modern web
00:06:51.680 design looks like. I mean, remember when buttons had shadows under them and stuff
00:06:57.120 like that. Yeah. Tier. Um, we've changed what you
00:07:02.880 know, like what fields get returned in APIs and certainly who's involved has
00:07:08.319 changed over the years. I certainly wasn't involved 15 years ago. Um, we,
00:07:14.080 you know, changed our test frameworks. Um
00:07:19.759 yeah so one of the things we wanted to highlight was how the original principles like haven't changed uh
00:07:25.680 despite a lot of things that may have flipped around. Um these are things that I set in motion a while ago and I think
00:07:32.160 it's really curious to like look back and reflect on that. Uh the first thing was that when we started when I started
00:07:37.520 this project like we didn't have an API for dealing with gems and we have a way better one now. Uh it was just scraping
00:07:42.960 a website before and this is definitely been achieved. Uh this started before GitHub could render markdown and re and
00:07:50.160 had readmemes everywhere. So we wanted easy ways to in to show how to install a gem and I think that was a big win. Uh
00:07:57.759 along with allowing the community to improve and enhance the site and here we are and I think that's like very clear
00:08:03.120 and obvious that a we've rallied around this thing and that's amazing that all of these have continued to matter these
00:08:10.319 original principles for what a package manager should be doing. Uh so let's think about the timeline a little bit.
00:08:16.400 Uh we wanted to do a little bit of history with this uh and show some some fun screenshots uh over the last 15
00:08:23.360 years or so. I found this amazing image uh for what Ruby Forge started as uh
00:08:29.520 which was a a clone of Source Forge from back in the day. And this is an image. There we go. That's okay. That's Rich
00:08:36.240 Kilmer's hand. Uh thumbs uping an amazing piece of hardware. Look at all that RAM. Uh
00:08:42.959 uh I don't even know what our what our machines are today there. Who knows? They're in AWS somewhere. It's there it
00:08:48.640 is. You could see it. And that's fun how that's changed over time. Um fast
00:08:54.000 forward a few years. GitHub uh had an amazing design at one point. And uh they
00:09:00.399 were building Ruby gems for a while. Um, the GitHub founders gave a talk, I think, at uh, RailsCom 2009, I believe,
00:09:08.000 where they said their biggest mistake and regret was building this very feature we're looking at today. And
00:09:13.680 that's part of what inspired me to like look at figuring out a better gem
00:09:19.120 situation for Ruby. Uh, fast forward a bit. Um, I was learning CSS clearly in
00:09:26.160 2009. Uh luckily uh some great folks at THBOT
00:09:32.000 where I was working at the time helped me with some really sick gradients on this. Uh look at uh also RSS remember
00:09:39.200 that that's wonderful. You could that was a thing for a while. Um few more years went by. I was really
00:09:46.240 lucky to work with the folks at Ruby Central to make rubygeems.org and the official host and we applied even more
00:09:52.000 gradients because that was the the great thing to do. Um, I think Oh, yeah. A thing to note here is the the front end
00:09:58.000 piece of this um has not changed a lot. So, that actually has made these kind of designs pretty easy since there's just
00:10:03.440 some jQuery sprinkles and I think they're still there. I'm so sorry. Uh, fast forward even more and we've got
00:10:10.720 this nice flat design that most people have seen and are using today. And, um, there's even a new one coming for uh,
00:10:18.640 this year. So, uh, this is a light and dark mode. looks very fancy, like it
00:10:23.680 belongs in the modern era. So, very excited that we're able to continue evolving what the site looks like and
00:10:29.360 give a better experience to folks. Uh, but overall, time is a flat circle. Um, I was so glad to have more folks help
00:10:36.079 out this project. Um, we've done so many changes with deployment that we're going to note on. Uh, but basically, I had
00:10:42.079 kids, I had a family, and I couldn't work for free. I think that makes a lot of sense. There's a lot of people in open source. I'm so glad that more
00:10:48.320 people were able to come in and help out. And turns out that answering a ton of support tickets and responding to
00:10:54.160 pages for free is just completely not sustainable. Maybe this is familiar to you and your uh on call teams. Aren't
00:11:00.079 you on call right now? Yeah, please don't take the site down. I want to get paid. But he's paid. That's the difference. Uh
00:11:07.120 also, lots more folks have helped out uh over time and I think that is the true
00:11:12.160 the true secret sauce here. Um I do want to do a little uh sidebar about burnout
00:11:18.959 uh because I think this is an important piece of uh project maintenance over time and evolution. Uh clearly uh
00:11:26.320 maintainers have to do a lot of uh emotional labor for those that are in issues. I want this feature. I wanted to
00:11:32.399 do X. It's 2 in the morning. I don't care. I care. Stop it. Uh being always
00:11:38.480 on too is like very very tough especially when there's other things in your life that might be a priority. Uh I
00:11:45.440 think lack of recognition and appreciation is also a thing that uh open source in general uh wrestles with.
00:11:51.839 The Ruby community does does a great job, but uh go look at Hacker News and maybe you'll understand why. Um
00:11:57.519 financial sustainability is another fun way to to burn out. Like this is especially challenging when you've got a
00:12:02.720 service like this one where it needs to run forever. Uh, I've told Sam and a few others that this service is going to
00:12:09.040 outlast me. I'll be long dead and we will need to make sure Rub jumps runs and that's terrifying. Uh, and someone
00:12:15.120 needs to pay for that. So, I hope we continue to figure that out in a few decades. And um, imposter syndrome and
00:12:20.800 perfectionism, making sure that this thing is like the most perfect thing. It never will be. And I think that's uh,
00:12:25.839 always going to be a problem no matter what project you're on. So, how do we not do any of that? Uh, number one is
00:12:32.320 just pay people to work on a project. Uh no really just pay them like you can pay you can pay people. It's an incredible
00:12:38.720 thought uh to like make sure that they are involved and there's accountability and that's I think really important. Um
00:12:44.720 you can set boundaries. Hey I'm not going to answer that ticket. I'm not going to go to that length to support
00:12:50.399 your user. We don't see that in a read me usually. It's like no just make an issue. Uh you can invite them to speak
00:12:56.000 at conferences 10 years later. Thanks Ruby central. Uh also don't be a jerk. I think it's
00:13:01.519 really important that like you are uh nice to the people that want to donate their time and energy to the thing that
00:13:07.519 you wrote. Uh what a concept. Uh some a little bit of bragging. Uh we I pulled
00:13:14.959 some slides from a talk I gave in 2011. We were doing around 4 million downloads a month and had 30 million total at the
00:13:21.920 time. Uh only 47 people working on the talk on the on the talk on the site.
00:13:27.600 Fast forward a few years, we've got 210 billion downloads total. I forget how many uh a day. It's like
00:13:34.560 a lot. Okay, that's a good number. Um uh 185,000 gems. I'm so proud of this.
00:13:40.639 Also, Bundler is like an outsized amount of all of them. Uh
00:13:46.000 that's a huge success. I think that we are uh able to reach so many folks and
00:13:51.920 use this. Definitely a success that my code has been downloaded so often. That's fair.
00:13:57.120 All right. Uh we do however uh want to remember.
00:14:03.199 So we just wanted to take a moment to remember the packages that have contributed to the success of
00:14:09.839 rubygeems.org over the years and that are unfortunately no longer with us.
00:14:16.000 We remember Cucumber. We remember writing specs in English instead of code. But was it really code?
00:14:24.079 We remember SAS. We remember writing CSS, but it was cooler and it didn't have any JavaScript. What a world.
00:14:32.079 We remember Chef. We We remember a world before Terraform when Ruby ruled the infrastructure
00:14:39.120 landscape before Go. We remember SCP deploys.
00:14:44.880 We remember a transfer was interrupted. Your server's down now.
00:14:50.720 We remember coffee script. We remember fat arrows and splats and using the
00:14:55.760 unless statement in frontend code. We remember mongrel. Actually, I still remember using
00:15:01.920 mongrel's parser in puma and unicorn.
00:15:07.360 We remember unicorn. Uh, we remember forcing everyone to
00:15:12.800 learn about Unix signals. We remember delayed job. We remember
00:15:19.279 trying to make HTTP requests work instead of inside of Rails controllers.
00:15:25.040 We remember Heroku. We remember when deploys were as simple
00:15:30.880 as get push Heroku master. We remember the vendor gems subm module.
00:15:37.440 We remember a time before Docker builds when deploys were slow and it was mostly our fault.
00:15:44.399 though if you departed from our gem file, you live on in our git history forever.
00:15:57.600 us. Uh we'd love to cover a little bit about security and why it's so important. Um this is I think a good
00:16:03.600 testament to how far things have come in the security world for Ruby gems. Uh, our first big hack was on Hacker News.
00:16:10.800 Not the usual topic of conversation on Hacker News, shockingly. Uh, but this one I was notified while I was on a bus
00:16:18.240 commuting. Uh, so we've come a long long way from from this uh from uh learning about security
00:16:25.440 incidents on everyone's favorite orange website. However, it's very clear that security isn't easy uh especially when
00:16:31.600 your services main uh business logic is around eval.
00:16:38.160 So yeah, security not so easy. Uh turns out that's kind of great for me as a
00:16:43.360 professional security engineer. Uh security being hard and everpresent is great job security. Um
00:16:52.079 one of the one of the things that we deal with is we're rubygeems.org or is a web app with a bunch of traffic and a
00:16:59.600 bunch of unauthenticated traffic that comes from around the world at all times
00:17:04.880 of day and all times of night. Um, it's got all of the security surface
00:17:11.120 area of every other Rails app, right? Like every every rack vulnerability,
00:17:18.079 um, every time there's uh, you know, a lib XML CVE, um, all that stuff affects
00:17:25.039 rubygeems.org. or just like it affects your apps. And then there's the fun stuff. Um, you
00:17:31.919 know, the reading and validating of gems and the YAML gem specs. And we've got
00:17:38.320 tarballs, which have z gzipped files of tarballs inside of them. Um, every
00:17:45.200 single word in that bullet point, by the way, is a way to do the site. Um, which
00:17:51.360 is real fun. And at the end of the day, like
00:17:57.200 rubygeems.org doesn't just exist as its own site. It exists so people can use the gems that it hosts. So we're
00:18:03.679 responsible for keeping the users of Ruby gems and bundler safe. Making sure that when you say gem install Rails, it
00:18:13.200 came from the Rails team. So, there are a lot of security challenges
00:18:19.919 that we're working on to this, you know, to this day. It didn't stop with Nick
00:18:25.200 being interrupted on a bus. Um, I guess that means our bus factor
00:18:31.120 has increased. Oh god, I hope so. Um, so I spent pretty much all of 2024
00:18:39.039 building a SIG store client in Ruby. Um, and now you've got uh trusted
00:18:46.000 addestations on rubygeems.org. So I can see like, hey, this gem came from this
00:18:51.039 repo. Woo, thumbs up. Um, we're working on building a trust
00:18:56.799 model around that. As I said, we we want you to know that when you install Rails,
00:19:02.799 it's the Rails gem from the Rails team and not the Riyals gem from the Riyals
00:19:08.960 team. Um that's R I ALS. Don't install that gem, please. You will get Rick rolled.
00:19:16.559 Um we maintain a uh a hacker one bug bounty program. Uh we get a ton a ton of
00:19:25.840 vulnerability reports, some of which are useful, many of which uh just I see this
00:19:32.960 this touched a nerve with Kevin here. um many of which are a complete waste of a
00:19:39.200 lot of time, but it's time that we have to spend investigating them. Um we work
00:19:45.679 with men to scan every package that's uploaded for uh exploits.
00:19:52.640 Um and along the way, we've learned a lot of lessons from doing this. Number
00:19:57.919 one is we're a big target. like lots of lots of users, people use rubygeems.org
00:20:05.200 to install code that runs on their machines. Um, kind of important to keep
00:20:10.559 it secure. Luckily, there haven't been any leftpad style issues. emphasis on the major and
00:20:18.640 the yet in that slide. But we have had plenty of other security
00:20:24.720 issues regularly from the interesting ones to the uninteresting. Uh hey just
00:20:31.440 like time to merge this dependabot PR and ship it and we're done.
00:20:38.000 And there are a lot of expectations. It's a very public service. People expect rubygeems.org to be up and
00:20:45.120 running constantly when it was down for a few days uh back 12 years ago. I don't
00:20:51.600 think the community was super happy about that. Um
00:20:57.200 and uh we even needed things like uh terms of use and an acceptable use
00:21:03.039 policy. Um you know those those like grown up and professional things. So thanks Marty for getting all those added
00:21:09.200 this year. So, who here loves talking about deploying applications? Forget
00:21:16.000 developing. Deploying is the fun part. Okay, some of you. Wow,
00:21:23.120 there are dozens of you. Um, I bet you all like writing YAML, too.
00:21:30.240 So I found this commit uh from October 12th, 2009
00:21:36.720 was five months into gem cutter existing as a service and for the first time a
00:21:43.840 gem file was introduced to the repo. It's hard to imagine but
00:21:51.280 rubygeems.org started off its life without like a dependency manager. there
00:21:56.720 was nothing that made everyone working on it use the same version of Rails or
00:22:02.080 of Rake or of anything. Um, of note in this commit, there isn't a lock file
00:22:09.280 yet. Uh, so adding in like lock files and making sure that everyone's running
00:22:15.440 the same code was a huge shift in how we deployed applications that happened
00:22:21.679 during the lifetime of rubygeems.org. We've also been through another big
00:22:27.919 shift in the industry and that's you know containers. Um,
00:22:33.440 containers have changed how we do deploys because we now have a single artifact that we can build and ship and
00:22:41.280 run anywhere instead of bes uh belovingly maintaining bespoke machines
00:22:48.000 and installing individual packages on them to uh make sure that they're in the correct state to run our precious little
00:22:54.960 application. So, something that I think is worth highlighting on how it's changed over
00:23:01.120 time is the community that's involved with the site. Um, this has definitely shifted quite a bit.
00:23:06.559 Uh, I found this hilarious photo of myself and some others at uh, Rails Camp in 2009. U, some folks in the Boston
00:23:13.600 Ruby community uh, and New England area rented a house way up in Maine, so north
00:23:18.960 that Tim Hortons was there, not Dunkin Donuts. I I'm sorry that maybe that reference doesn't land in the land of
00:23:24.640 Wawa. Um, but uh I look like a child. I am a child in this. I'm presenting on an
00:23:32.559 easel, which is insane. Uh, I ran Gem Cutter at the time on a Mac Mini that I
00:23:38.480 brought uh to this and we tried it out and we were hacking on it a lot during this. I'm pretty sure I slept on on top
00:23:44.799 of a jacuzzi. A jacuzzi. Don't ask question more questions about that situation. uh but it has evolved a long
00:23:52.559 long way from uh from this particular scenario. Something that also I think has evolved is like how we talk uh about
00:23:59.919 the project. Um I found some mad person who had uh kept archives of the Ruby
00:24:05.360 gems and other associated Ruby channels um IRC logs from 2013. I was answering
00:24:12.720 questions about this on the days my kids were born. Yikes. Um uh but some things
00:24:17.840 haven't changed. Like I found this. Uh I'm ready to throw my computer out of window. This is the same. I am the same
00:24:23.679 person still. And I was yelling about Bundler. So, okay, we've we've come a long way
00:24:31.520 from, you know, just Nick being in Maine presenting on an easel and a Mac Mini.
00:24:38.799 We've now got over 500 contributors to the repo. you can you can see this cool
00:24:44.320 little animation of people contributing over time. Um, that's that's a lot of
00:24:50.960 that's a lot of people and in fact I know that we've got more than just the two of us up here on stage who have
00:24:57.360 contributed to rubygeems.org. Um, some of them in particular I would
00:25:02.799 like to uh shout out and really thank.
00:25:07.840 Um, some of you are in this room, so give yourselves a quick round of applause.
00:25:18.880 Without contributions from these amazing individuals and so many others, like
00:25:25.039 rubygeems.org would not exist in the state that it is today.
00:25:31.039 um it would not be like running without any hiccups while I'm standing up here
00:25:36.640 on stage. Uh so you know I'm just super grateful for
00:25:42.960 everyone who contributed to this project over the past decade and a half.
00:25:50.080 So in the past couple of years we've hopefully made some improvements.
00:25:57.200 Um, and I just wanted to highlight some of the big changes that have happened. Um, thanks to a bunch of grants we've
00:26:05.520 gotten from grant making organizations, we focused on making operating rubygeems.org easier. Um, basically so
00:26:14.960 that when stuff happens and you are on a bus, you can deal with it and not carry
00:26:22.880 lifelong trauma afterwards. Uh, sounds right. Sounds good, right?
00:26:28.640 Fair. Um, so for example, we now have an admin panel where we can yank gems and stuff
00:26:35.360 instead of having people SSH onto production machines. There's a pager duty rotation. So, if
00:26:42.320 you're on a bus, at least you know you're going to get paged while you're on that bus.
00:26:47.919 Um, we have all the like cool modern observability stuff. So when things
00:26:54.080 break, we can figure out how they broke and why they broke and maybe even fix
00:26:59.279 what broke. Uh we've hopped on that like infrastructure as code bandwagon. So if
00:27:07.679 someone goes on vacation, the knowledge of how all the infrastructure is set up doesn't go on vacation as well. Um
00:27:16.080 unless GitHub is down and then I guess this knowledge is on vacation. Um, and as I mentioned, we have policies
00:27:23.600 for things. So, when we get emails saying, "Hey, you have to remove this gem," uh, we don't just make arbitrary
00:27:31.840 decisions about that anymore. Uh, there's a document that users have
00:27:37.200 agreed to that we can read and blame the document for the decision.
00:27:45.600 And we're not done. Like, the the site's not finished. Um, you know, here's a preview of some of
00:27:52.320 the things that we're working on from Ruby Central's, you know, current public roadmap. Um, we want to build a gem
00:28:00.640 content browser so you can see what is in a gem before you install it. Novel
00:28:06.640 concept. Uh, a diff viewer so you can see what has
00:28:12.159 changed between version 3.0.1 and 3.0.1.1 and 3.0.2. too.
00:28:20.559 Uh, we'd love to host a vulnerability advisory database for gems. Um, I know
00:28:26.240 that CVEEs are a super scary thing and we don't want to make people in the Ruby
00:28:31.360 community deal with them when they're not necessary. Um, and maybe we'll change how Yanking
00:28:37.120 works again. It's going to be fine. Don't worry about it. Trust me. Um, but what I want to point out is that this
00:28:43.840 current road map isn't limited by Rails. Like our choice of framework, choice of
00:28:49.919 framework that Nick made 15 years ago is still not getting in the way of the things we want to do.
00:28:57.600 So now you're probably thinking that that all sounds great. I want to be involved.
00:29:04.080 Well, none of this would be possible without open source contributors like you.
00:29:10.880 So, we're we're running a bit short on time, so I'm going to rush through this. Uh, but there's a bunch of different
00:29:17.520 ways that you can contribute. Um, code, documentation, design. Also, you can you
00:29:24.640 can just pay us. Like, seriously, you can just pay us. Uh, it does make things better.
00:29:30.880 Um, you know, we've got a hopefully a bunch of ways to make onboarding uh code
00:29:38.080 contributions easier. Um, we need API documentation. We've needed it for 15
00:29:44.480 years. If you want to add it, that would be amazing. If not, maybe next year. Um,
00:29:50.480 there's that new design system that we're working on rolling out. So, if you want to make things like responsive and
00:29:56.559 have dark mode and not be blinded by that one orange color uh when on the
00:30:02.240 site, please help out. Um, and yeah, the cool
00:30:08.559 thing is rubygeems.org is just a Rails app. Like you all know how to work on a
00:30:16.240 Rails app and contribute to that. So, uh, clone the repo and, you know, join us tomorrow at hackspaces and get
00:30:23.760 started contributing to rubygeems.org. All right. So, to wrap up, it's very
00:30:28.960 clear most open source projects don't last for 16 years. Uh, we're so grateful for the community support to like make
00:30:34.399 this happen and wouldn't happen without uh people helping us. Uh, funding is
00:30:41.600 difficult and I think when a service has to run forever, that makes it even
00:30:46.720 harder. So we do that we we make it easier by focusing on what will change
00:30:51.919 instead of won't. So we know the people will pro will definitely change. We know what won't change is you know how hard
00:30:58.080 the problem domain in the security space is. So we need to make sure that uh there's always new folks coming in to
00:31:04.880 help. And of course for those folks old and new you could say thanks and that will help. Uh that's the big takeaways
00:31:12.000 we've got. Um we did want to say thank you to some to some sponsors especially Ruby Central. Um everything uh
00:31:17.279 infrastructure- wise is uh not only here but in the footer as well because those these sponsors do make a huge
00:31:23.520 difference. We really couldn't run the site especially without quite a few of these. Uh that's what we've got. You can
00:31:28.880 catch us in the hallway track or tomorrow at the uh the hack space and um
00:31:34.240 we'll be happy to get you running or answer any questions you have. Thank you.
Explore all talks recorded at RailsConf 2025
Ben Sheldon
Sam Poder
Rhiannon Payne
Joe Masilotti
Josh Puetz
Wade Winningham
Irina Nazarova
Tess Griffin
+77