2 ms·
RubyGems Open Source Supply Chain Security and OpenAI
- thomascountz 12d agoRelated: What a time to be alive – rouge AI agents attack RubyGems.org (tenderlovemaking.com) - https://news.ycombinator.com/item?id=49695876 https://news.ycombinator.com/item?id=49695876 - Sept 2026 (123 comments)
- rietta 12d agoUnrelated to the content of this post, I fixed the website header to be much smaller and unobtrusive while reading. Tested on my iPhone and in the Firefox responsive simulator as promised in the comments there.
- devy 12d agoTwo chilling effects Mr. Rietta brought up that are legit and happening right now: 1. "When a critical CVE is published impacting a publicly accessible system, think again. You have hours at most. All organizations have to process changes to match this reality on the ground." 2. “AIs are also good at reverse-engineering exploits from patches, which means that these vulnerabilities will be weaponized as soon as the update is published.” Yes, it helps defenders long term but in the short term it is a weapon most are not ready for.
- lrvick 12d agoNeat. Do Homebrew, Alpine, and NixPkgs next! Yolo projects like those are never going to learn until the supply chain attacks actually happen, and I long ago gave up trying to convince them. From a safe distance, I am finding myself rooting for AI agents to speedrun the attacks because no one listens. Maybe on the other side we can finally normalize sane software distribution practices.