3 ms·
Rubygem should contract an external auditor (security firm), this could go way deeper. Until they perform a throughout audit I will personally stay away from th
by huxflux 7y ago
Rubygem should contract an external auditor (security firm), this could go way deeper. Until they perform a throughout audit I will personally stay away from this project.
- FDSGSG 7y agoSo why does this not apply to everything? If "this could go way deeper" is your answer to a super unpopular rubygem getting hijacked, why isn't that just the default assumption then? Do you only use thoroughly audited software projects? How do you manage that?
- raesene9 7y agoHow do you suggest that Rubygems fund that effort? Also when you're staying away from Rubygems, which alternative will you be using, and do you think they have better security?
- archy_ 7y agoIncidents like this really show the lack of proper security measures in place. Why should package ownership be able to be arbitrarily shifted on a whim? It's a large signle point of failure. Sadly, there are no good alternatives besides entering in in GitHub repo paths manually for now.