ok. security. everyone is soooo concerned about it... A few questions for you: * When was the last time you personally verified gem sources that you built and

ok. security. everyone is soooo concerned about it... A few questions for you: * When was the last time you personally verified gem sources that you built and installed? * did you ever install software not from the big known sources that are verified on the OS level? * did you ever install a gem from github (do you even know you are talking to github?) * "wget http://somewhere/archive.tgz http://somewhere/archive.tgz; tar zxf archive.tgz;cd archive;sudo make install" anyone? * rails -m http://github.com/some_cool_template.rb http://github.com/some_cool_template.rb? * do you cryptographicaly sign your own sources and verify the signature during production deployments? May be http_require is just for you. if you "failed" on any of the above, you might to be as ignorant over casual security as I am :). Security is always a tradeoff with convenience. When you consider the effort required to actually perform a man in the middle attack or some other kind of attack when you install something from github versus how hard is it to just break into your house and steal the laptop you might just decide that running some code directly from github might not be such a bad idea :) But more importantly, the intended usage is over a secured network. vpn, ssh or ssl tunnel or even http://localhost http://localhost (serving from protected directory with some ACL). I can think of many many situations where this is just 'right'. The standard capistrano/vlad way of delivering the sources is rsync or git over ssh (or even SVN over HTTP!) How is this more secure then fetching a source over http though the same ssh tunnel (forwarded localhost, i.e. SSH -L...)?