3 ms·
Respectfully, RubyGems has already been compromised. Not telling anyone has zero advantages to RubyGem users. Telling people to avoid using RubyGems and to aud
by ig1 14y ago
Respectfully, RubyGems has already been compromised. Not telling anyone has zero advantages to RubyGem users.
Telling people to avoid using RubyGems and to audit if they've used it recently helps protect users.
Responsible disclosure is about avoiding giving bad guys new attack vectors and ensuring that the maintainer has the best chance of fixing the issue before a blackhat discovers and exploits it. That doesn't apply in this case.
- tangue 14y agoTotally agree. I know it's a pain for the admins, but you can't say something like "security is omakase."
- benatkin 14y agoI think you meant to say "respectfully". I agree, but how do people audit? I think it's time to start putting application dependencies, like rubygems and npm modules, under version control, not in the same repo, but in a different repo. Mikeal Rogers has some good reasons why, but there gets to be too much commit noise if you have big dependencies, and put them in the same repo. A separate repo solves this. http://www.futurealoof.com/posts/nodemodules-in-git.html http://www.futurealoof.com/posts/nodemodules-in-git.html
- ig1 14y agoYes I did, fixed.