4 ms·
it looks like someone has tried to steal rubygems.org db and other credentials. bundle update is now dangerous because you might get trojaned files.
by benmmurphy 14y ago
it looks like someone has tried to steal rubygems.org db and other credentials. bundle update is now dangerous because you might get trojaned files.
- benmanns 14y agoBut don't applications have to explicitly install this gem? If not, then I am incorrect.
- bradleyland 14y agoWe don't know the extent to which Rubygems was compromised yet. In a scenario like this, it's best to err on the safe side and avoid trusting the source for the time being.
- bittersweet 14y agoQrush, one of the guys behind Rubygems tweeted that the credentials of every yml file ended up on pastie: https://twitter.com/qrush/status/296638346283868160 https://twitter.com/qrush/status/296638346283868160 > Someone posted http://rubygems.org http://rubygems.org 's config/*.yml to pastie. Didn't include the S3 bucket secret key, but going to reset everything anyway.