RubyGems
Shares rank 8 of 9 package repositories by recommenders
Main Ruby package registry, valued for being stable and easy to use, but critics object to Ruby Central's governance and a 100k download removal limit.
Main Ruby package registry, valued for being stable and easy to use, but critics object to Ruby Central's governance and a 100k download removal limit.
16 people gave an opinion
- recommend it
- 6
- criticize it
- 10
- approval share
- 38%
Recommended in 5 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 6 people recommend itNeeds 10 or more, not met.
- 0.6 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Finding and using Ruby software
“Personally, if I want to find software, I use Google, Rubygems, or NPM.”
Comment from 29 Apr 2026 in “Tangled – We need a federation of forges” “I use it quite a bit when I have to monkeypatch a gem”
Comment from 7 Nov 2025 in “Ruby already solved my problem” Well maintained and unexciting
“bundler and rubygems are being maintained ably, if not better, by hsbt”
Comment from 31 Jul 2026 in “Ruby Central's Destructive Legacy” “compared to NPM, RubyGems is (lately) unexciting in the best way”
Comment from 18 Apr 2026 in “Optimizing Ruby Path Methods” Team praised for handling issues
“I've been impressed by how well he is doing with it.”
Comment from 31 Jul 2026 in “Ruby Central's Destructive Legacy” “Kudos to RubyGems team for handling it”
Comment from 11 Sep 2026 in “OpenAI agents carried out an undisclosed attack on RubyGems”
What people warn about
Each mark is one comment
100k download removal limit
“they went loco and added anti-people things such as taking away your ability to remove old gems past a 100k download arbitrary limit”
Comment from 14 Sep 2026 in “OpenAI bots knew about the RubyGems caching vulnerability” “adding arbitrary 100.000 download limits (past that point you can no longer remove your project from rubygems.org”
Comment from 26 Jul 2026 in “Calling all open source maintainers working with Ruby” “RubyCentral had no authority over me or my projects, but still decided to add that pointless 100k download limit”
Comment from 26 Jul 2026 in “Calling all open source maintainers working with Ruby” - Comment from 16 Nov 2025 in “The fate of "small" open source”
- Comment from 10 Apr 2026 in “Microsoft suspends dev accounts for high-profile open source projects”
- Comment from 16 Nov 2025 in “The fate of "small" open source”
Corporate and hostile governance concerns
“I stopped using rubygems.org myself after Marty pushed the ecosystem into shopify's corporate pet project.”
Comment from 12 Mar 2026 in “Returning to Rails in 2026” “I noticed this some time ago with regard to RubyCentral slapping down meta-corporate rules on rubygems.org”
Comment from 22 Nov 2025 in “Arduino Terms of Service and Privacy Policy update: setting the record straight” “on rubygems.org, before RubyCentral went shopify-controlled-only, that people would occupy namespaces”
Comment from 18 Nov 2025 in “Ruby 4.0.0 Preview2” - Comment from 27 Dec 2025 in “T-Ruby is Ruby with syntax for types”
- Comment from 30 Mar 2026 in “A Message from the Ruby Central Board”
- Comment from 16 Apr 2026 in “Laravel raised money and now injects ads directly into your agent”
Supply-chain security risks
“you should also not trust pypi, rubygems, cargo and all the other programming language package managers.”
Comment from 24 Nov 2025 in “Shai-Hulud Returns: Over 300 NPM Packages Infected” “rubygems has governance issues that spawned gem.coop and numerous supply-chain vulnerabilities”
Comment from 27 Dec 2025 in “T-Ruby is Ruby with syntax for types” “I can just make an account and push whatever I want.”
Comment from 1 Jun 2026 in “NPM packages from RedHat have been compromised”
Other package repositories people recommend
The four most recommended other package repositories, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Nixpkgs | 38 | 22 | 63% | 11 | — | — |
| Arch User Repository | 34 | 74 | 31% | 5 | — | — |
| Arch User Repository | 20 | 23 | 47% | 10 | — | — |
| crates.io | 17 | 18 | 49% | 9 | — | — |
| RubyGemsThis page | 6 | 10 | 38% | 5 | — | — |
What people said
35 of the 36 comments that mention it, newest first. Each links to the original comment.
“they went loco and added anti-people things such as taking away your ability to remove old gems past a 100k download arbitrary limit”
“Why is Ruby Gems such a mess? It seems as bad as PyPI now.”
“Kudos to RubyGems team for handling it”
“the silly 100k downloads restriction at rubygems”
“I've been impressed by how well he is doing with it.”
“The folks who were responsible for ruining rubygems.org should really reconsider.”
“things really changed to the worse”
“bundler and rubygems are being maintained ably, if not better, by hsbt”
“RubyCentral had no authority over me or my projects, but still decided to add that pointless 100k download limit”
“adding arbitrary 100.000 download limits (past that point you can no longer remove your project from rubygems.org”
“I can just make an account and push whatever I want.”
“semi-decent packaging systems like the ones you mention have lockfiles”
“Personally, if I want to find software, I use Google, Rubygems, or NPM.”
“The final straw was the 100k download limit”
“compared to NPM, RubyGems is (lately) unexciting in the best way”
“decided it must become a shopify-corporation project only”
“rubygems.org is basically just shopifygems.org now”
“this was why I retired from using rubygems.org”
“I abandoned rubygems.org when they added the 100.000 download limit”
“PyPI and RubyGems have had the same mess”
“they literally stole open source projects in a hostile GitHub takeover”
“it turns out none of their justifications had any basis in fact”
“I stopped using rubygems.org myself after Marty pushed the ecosystem into shopify's corporate pet project.”
“I hate the corporate identity rubygems.org adopted”
“corporate-controlled rubygems.org”
“rubygems has governance issues that spawned gem.coop and numerous supply-chain vulnerabilities”
“Sadly, they seem to have removed this alias library sometime around Ruby 2.4.”
“they also added a 100.000 download limit”
“you should also not trust pypi, rubygems, cargo and all the other programming language package managers.”
“I noticed this some time ago with regard to RubyCentral slapping down meta-corporate rules on rubygems.org”
“on rubygems.org, before RubyCentral went shopify-controlled-only, that people would occupy namespaces”
“I retired permanently from rubygems.org in 2024 due to the 100k download limit”
“the arbitrary 100k download limit for gems hosted at rubygems.org”
“rather than fix on existing problems, eliminate all former maintainers”
“I use it quite a bit when I have to monkeypatch a gem”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.