4 ms·
Having done this, it’s not worth the effort to implement if you using more than a handful of gems and a handful of gems is really easy to inspect using diff. A
by kayodelycaon 3y ago
Having done this, it’s not worth the effort to implement if you using more than a handful of gems and a handful of gems is really easy to inspect using diff.
And bundler isn’t aware of external C libraries you’d need to inspect.
Auditing tools using a database of known vulnerabilities is the only scalable solution I know of.
- baggy_trough 3y agoTo get many eyeballs on gem diffs, we need an easy tool.
- freedomben 3y agoI think what GP is getting at, and is something I've hit as well in the past when auditing diffs, is that it's just not feasible. For a small project maybe, but for a medium to large Rails app for example you would need to dedicate potential multiple full time engineering to do nothing but review diffs. Things change fast, and a lot of the changes are not simple patchsets you can eyeball. Without some domain knowledge and even context such as "did they just refactor or is this a total rewrite" it can be very difficult to even understand what you're reading without a bunch of extra work. At a minimum you need to read the commit log in addition to the diffs. Personally, this is an area where I think AI could add a huge amount of value. An AI tool that looks at your gem versions (or node or elixir, whatever) and then reads all the commits that changed and reviews them for safety/security and maybe summarizes them, could be huge.
- kayodelycaon 3y agoI wouldn't even bother with deep analysis without access to the repo on Github or a similar site where I can see the PRs and their discussions.