3 ms·

We thought about this. We don't associate any gemfiles with user information, so at best… all you could get is a list of vulnerable gemfiles, somewhere, out th

• shostack 11y ago
  Novice here, but wouldn't a list of vulnerable gems be almost as valuable a target (if it doesn't already exist elsewhere)? I would imagine it is not difficult to generate a list of sites using those versions of gems that have public repos. Please feel free to educate me if that is not at all the case though--like I said, novice, so just starting to wrap my head around security implications of things like this.
  • Cyranix 11y ago
    Not sure why you were downvoted for asking a question and trying to learn. The information is coming from publicly available descriptions of vulnerabilities. The affected versions of gems are already enumerated. This tool is a way to make it easier for devs to compare their set of gems against the vast database of vulnerabilities.
    • shostack 11y ago
      Thanks for the helpful response, this is exactly what I was wondering as I assumed there might be some publicly available info on vulnerabilities. Is there a definitive source for keeping track of these out of curiosity? I'd consider myself an "early" programmer, so I know enough to be dangerous, but feel like there's no time like the present to start keeping track of known issues with things I might be using, even if I may not grasp the full extent of them at my level of experience.