> Given these two points, I really believe we should not be posting "hey we are not vulnerable" blog posts here because at best they are useless noise (nobody a

> Given these two points, I really believe we should not be posting "hey we are not vulnerable" blog posts here because at best they are useless noise (nobody aside of debian or redhat and their downstreams is vulnerable) and at worst false assurances. Nobody has said this. The post says specifically that nothing on RubyGems is known to use the known backdoor; nobody has made (or could reasonably make) claims about unknown future backdoors. It’s incumbent on you to understand that this kind of announcement doesn’t imply the absence of potential future ones.