4 ms·

Where are the adults? This is absolute amateurism. Why haven't Heroku or GitHub or some actual professionals in the Ruby community, stepped up to ensure that th

Where are the adults? This is absolute amateurism. Why haven't Heroku or GitHub or some actual professionals in the Ruby community, stepped up to ensure that this kind of amateurism doesn't damage their ecosystem? [Throwaway as I'm a small-fish in the Ruby community. I expect I'll get to use this account again soon though]

pifflesnort 14y ago
This is exactly what I'm wondering. Are there adults in the Ruby community? The vulnerability itself is simply ridiculous: https://github.com/tenderlove/psych/issues/119 https://github.com/tenderlove/psych/issues/119 The response from the Gem folks has betrayed a serious lack of experience. Has Rails been such an insular and young community for so long that there are truly no qualified engineers around with experience in this level of professional software development?
- dbenhur 14y ago
  The problem is any YAML loader which supports tags that can name arbitrary classes and have existent classes whose initialization may `eval` the supplied values. Ruby is very publicly hurting, but equivalent vulnerabilities exist in other runtimes, such as Perl via [YAML::Syck](http://search.cpan.org/~toddr/YAML-Syck-1.22/lib/YAML/Syck.pm http://search.cpan.org/~toddr/YAML-Syck-1.22/lib/YAML/Syck.p...) or Python via [PyYAML](http://pyyaml.org/wiki/PyYAML http://pyyaml.org/wiki/PyYAML) and [LibYAML](http://pyyaml.org/wiki/LibYAML http://pyyaml.org/wiki/LibYAML). If your language can accept and load untrusted yaml and your language has `eval`, you're probably fucked and just don't know it yet.
  - batiste 14y ago
    The problem is that YAML is used by Rails & Co as a parser for untrusted user-provided data. It does not matter if there is buggy implementation in Python/Perl if nobody use them. If other framework were using YAML in this fashion, yesterday will be the time to look for security holes in those implementations.

pifflesnort 14y ago

This is exactly what I'm wondering. Are there adults in the Ruby community? The vulnerability itself is simply ridiculous: https://github.com/tenderlove/psych/issues/119 https://github.com/tenderlove/psych/issues/119 The response from the Gem folks has betrayed a serious lack of experience. Has Rails been such an insular and young community for so long that there are truly no qualified engineers around with experience in this level of professional software development?

dbenhur 14y ago
The problem is any YAML loader which supports tags that can name arbitrary classes and have existent classes whose initialization may `eval` the supplied values. Ruby is very publicly hurting, but equivalent vulnerabilities exist in other runtimes, such as Perl via [YAML::Syck](http://search.cpan.org/~toddr/YAML-Syck-1.22/lib/YAML/Syck.pm http://search.cpan.org/~toddr/YAML-Syck-1.22/lib/YAML/Syck.p...) or Python via [PyYAML](http://pyyaml.org/wiki/PyYAML http://pyyaml.org/wiki/PyYAML) and [LibYAML](http://pyyaml.org/wiki/LibYAML http://pyyaml.org/wiki/LibYAML). If your language can accept and load untrusted yaml and your language has `eval`, you're probably fucked and just don't know it yet.
- batiste 14y ago
  The problem is that YAML is used by Rails & Co as a parser for untrusted user-provided data. It does not matter if there is buggy implementation in Python/Perl if nobody use them. If other framework were using YAML in this fashion, yesterday will be the time to look for security holes in those implementations.