5 ms·
Not sure why you were downvoted for asking a question and trying to learn. The information is coming from publicly available descriptions of vulnerabilities. T
by Cyranix 11y ago
Not sure why you were downvoted for asking a question and trying to learn.
The information is coming from publicly available descriptions of vulnerabilities. The affected versions of gems are already enumerated. This tool is a way to make it easier for devs to compare their set of gems against the vast database of vulnerabilities.
- shostack 11y agoThanks for the helpful response, this is exactly what I was wondering as I assumed there might be some publicly available info on vulnerabilities. Is there a definitive source for keeping track of these out of curiosity? I'd consider myself an "early" programmer, so I know enough to be dangerous, but feel like there's no time like the present to start keeping track of known issues with things I might be using, even if I may not grasp the full extent of them at my level of experience.