To be honest, the same problem exists for RubyForge, since you could build/release a gem with a user name prefix and it doesn't check. The short answer is: be

To be honest, the same problem exists for RubyForge, since you could build/release a gem with a user name prefix and it doesn't check. The short answer is: be explicit with what source you're looking at, and start looking into gem signing/certs since it's the way we can trust gems. More info here: http://litanyagainstfear.com/blog/2009/10/09/on-gem-forking/ http://litanyagainstfear.com/blog/2009/10/09/on-gem-forking/ *Edit: Looks like rufo already cleared this up...thanks man!