4 ms·

I'm on an iPhone and going to dinner in a second, but can someone tell them that Gem::Requirements line is a pretty dead ringer for the YAML exploits from Janua

by patio11 13y ago

I'm on an iPhone and going to dinner in a second, but can someone tell them that Gem::Requirements line is a pretty dead ringer for the YAML exploits from January? Servers that haven't been owned yet should update Rails, see my article from January. Owned servers need to get rebuilt from metal, as per usual.

glimcat 13y ago
Article: "What The Rails Security Issue Means For Your Startup" http://www.kalzumeus.com/2013/01/31/what-the-rails-security-issue-means-for-your-startup/ http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...
- InclinedPlane 13y ago
  Pssst, patio11 wrote that. Regardless, it's an absolute must read for anyone even thinking about using rails.
lbarrow 13y ago
It's surprising how often people rely on their own obscurity when they hear about security vulnerabilities. Sure, I could go upgrade Rails, but why bother? I'm only using it for a personal project. The reality is that bad actors scan the pubic Internet for exploitable servers all the time. It's easy, it's cheap, and it's a very effective way to grow your botnet. If you're on the Internet, it doesn't matter how obscure you are: someone will eventually probe you.
- kawsper 13y ago
  Seriously, these guys have been completely out of the loop. > I think we have to warm all RoR developers...
  - lotyrin 13y ago
    These are the average developer. Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
    - astrodust 13y ago
      Thus, if you don't know what you're doing, subscribe to a service like Gem Canary (http://gemcanary.com/ http://gemcanary.com/) so you get alerts.
      - borski 13y ago
        We also have a mailing list we regularly send out updates to that we set up after the Rails vuln fiasco - you can sign up for it here, if interested: https://www.tinfoilsecurity.com/railscheck https://www.tinfoilsecurity.com/railscheck
      - graue 13y ago
        I like this. Is there anything comparable for Python or Node.js?
        sirclueless 13y ago
        Yes, try https://bundlescout.com/ https://bundlescout.com/ Also http://getshrubbery.com/home http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
        quarterto 13y ago
        Try https://david-dm.org/ https://david-dm.org/ for node.js.
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]

by patio11 13y ago

glimcat 13y ago

Article: "What The Rails Security Issue Means For Your Startup" http://www.kalzumeus.com/2013/01/31/what-the-rails-security-issue-means-for-your-startup/ http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...

InclinedPlane 13y ago
Pssst, patio11 wrote that. Regardless, it's an absolute must read for anyone even thinking about using rails.

lbarrow 13y ago

It's surprising how often people rely on their own obscurity when they hear about security vulnerabilities. Sure, I could go upgrade Rails, but why bother? I'm only using it for a personal project. The reality is that bad actors scan the pubic Internet for exploitable servers all the time. It's easy, it's cheap, and it's a very effective way to grow your botnet. If you're on the Internet, it doesn't matter how obscure you are: someone will eventually probe you.

kawsper 13y ago
Seriously, these guys have been completely out of the loop. > I think we have to warm all RoR developers...
- lotyrin 13y ago
  These are the average developer. Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
  - astrodust 13y ago
    Thus, if you don't know what you're doing, subscribe to a service like Gem Canary (http://gemcanary.com/ http://gemcanary.com/) so you get alerts.
    - borski 13y ago
      We also have a mailing list we regularly send out updates to that we set up after the Rails vuln fiasco - you can sign up for it here, if interested: https://www.tinfoilsecurity.com/railscheck https://www.tinfoilsecurity.com/railscheck
    - graue 13y ago
      I like this. Is there anything comparable for Python or Node.js?
      - sirclueless 13y ago
        Yes, try https://bundlescout.com/ https://bundlescout.com/ Also http://getshrubbery.com/home http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
      - quarterto 13y ago
        Try https://david-dm.org/ https://david-dm.org/ for node.js.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]