2fa should always be on. 1) Signing should always happen. Publish time + hashes of external resources should be taken into account to prevent meddling with thi

2fa should always be on. 1) Signing should always happen. Publish time + hashes of external resources should be taken into account to prevent meddling with things after the fact. 2- a much harder solution) Don't use so many libraries. In this way I think it's borderline impossible. Of course this vuln targeted `bootstrap-sass`.. it's basically a default gem for new rails installations since bootstrap is so commonly used. Actually, rails 6.0 not only installs dependencies for you upon generating a new app, but it downloads yarn and installs 602 dependencies too. It's a miracle we do anything as programmers.