5 ms·
These are the average developer. Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or lo
by lotyrin 13y ago
These are the average developer.
Every time I touch a new project it's in need of security updates. Any time a site gets owned, there's no accountability or logging or anything. Any time a security issue does manage to get found it's as if it's a rare new thing. "Wow, who would have thought that could happen." Well, let's see, the developers of the software you're using, and anyone that pays attention to them.
- astrodust 13y agoThus, if you don't know what you're doing, subscribe to a service like Gem Canary (http://gemcanary.com/ http://gemcanary.com/) so you get alerts.
- borski 13y agoWe also have a mailing list we regularly send out updates to that we set up after the Rails vuln fiasco - you can sign up for it here, if interested: https://www.tinfoilsecurity.com/railscheck https://www.tinfoilsecurity.com/railscheck
- graue 13y agoI like this. Is there anything comparable for Python or Node.js?
- sirclueless 13y agoYes, try https://bundlescout.com/ https://bundlescout.com/ Also http://getshrubbery.com/home http://getshrubbery.com/home which is free, but seemed mildly broken when I tried it (it seemed to forget some of my actually outdated packages when I tried it).
- quarterto 13y agoTry https://david-dm.org/ https://david-dm.org/ for node.js.