It's imporant to pick out vulnerabilities and deficiencies compared to other projects to get them addressed, rather than only say nice things. However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov).

For example, all new gem releases should be signed and `HighSecurity` should be the policy but it's taken years to get very little progress. Changing to that policy would prevent entire classes of attacks, attacks that could subtly inject code into all sorts of apps in difficult-to-find ways. Large projects are still shipping unsigned gems, unsigned commits and unsigned tags. If RubyGems were hacked, progress might move slightly faster.