4 ms·
Which brings us to the old saying: Do not deserialize untrusted data. In the context of Rubygems and their specs this obviously is harder to manage but depende
by sebiw 2mo ago
Which brings us to the old saying: Do not deserialize untrusted data.
In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.
- sscaryterry 2mo ago> dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base This mindset is changing, in the npm ecosystem, managing and updating dependencies have become somewhat of a gamble. It is no longer if, its when you are compromised.
- _joel 2mo agoChecksumming the dependencies in the Gemfile may help. https://blog.rubygems.org/2024/12/19/bundler-v2-6.html https://blog.rubygems.org/2024/12/19/bundler-v2-6.html
- sscaryterry 2mo agoAccounts get compromised, no checksumming in the world can help with that.
- rjsw 2mo agoI have to use several gems that download and compile C sources from github at install time.
- manewitz 2mo agoGemfile.lock checksums by default on bundler 4+
- jbverschoor 2mo agoGems/packages should explicitly declare what kind of features they need/want (file, net, deserialization, execute) And when the sig. changes, you should get a warning Very similar to the iOS entitlements
- wyager 2mo ago> Do not deserialize untrusted data. I think the better lesson is "use safe codecs"
- ares623 2mo agoLLMs: hold my beer