3 ms·
How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package n
by csdreamer7 9y ago
How does RubyGems handle a package being removed and replaced by a different (and maybe malicious) actor? Not allow a package to be deleted? Block the package name from being claimed by someone else?
- eric_h 9y agoFrom http://help.rubygems.org/kb/gemcutter/removing-a-published-rubygem http://help.rubygems.org/kb/gemcutter/removing-a-published-r...: > Once you've yanked all versions of a gem, anyone can push onto that same gem namespace and effectively take it over. This way, we kind of automate the process of taking over old gem namespaces.
- shostack 9y agoSo basically--gem bundler beware?
- csdreamer7 9y agoThank you Eric.
- Footkerchief 9y agoThere are also people requesting that this be changed: https://github.com/rubygems/rubygems.org/issues/1226 https://github.com/rubygems/rubygems.org/issues/1226