Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby deploys temporarily disabled

status.heroku.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Ruby deploys temporarily disabled

#91

Post by krickle »

charliesome wrote: post #75
1qaz2wsx3edc wrote: post #69

Earlier quoted context omitted.

Semi related CVEs aside (CVE-2013-0333 and CVE-2013-0156): YAML's security problems have been known for years by the community. YAML aside, don't trust user input. This is egg on rubygems's face and the ruby community. I don't think http://rubycentral.org/ has full-time staff for rubygems either. Gems, specifically should be signed. They are not, this type of exploit will continue to happen, hell, remember when githu…

The GIL is not really a problem. There are far more pressing issues with MRI, and many core developers are working hard to solve these.

Like what? I thought the GIL and GC forcing COW were the largest problems bar none.

Re: Ruby deploys temporarily disabled

#92

Post by jordanthoms »

kawsper wrote: post #79
cobrabyte wrote: post #49

Earlier quoted context omitted.

Agreed. I was surprised when I received an email from Heroku letting me know that a few of my apps needed to be updated after the Rails vulnerabilities were uncovered. They also named the apps that needed to be updated, which makes my job that much simpler.

It was a nice service with the mail. But it was sent one day after the exploit was out in the open, which is too late, but better than nothing.

I guess they had to build the feature. With the follow-on exploit for rails <3.1, the notification email went out very quickly and probably they will have quick notifications going forward.

Re: Ruby deploys temporarily disabled

#93

Post by xanido »

redeemedfadi wrote: post #43
scotje wrote: post #29

Earlier quoted context omitted.

If you use bundler, "bundle package" can help reduce or eliminate your dependency on external gem repositories. At least for deployments. I generally try to follow the "vendor everything" philosophy: http://ryan.mcgeary.org/2011/02/09/vendor-everything-still-a...

I couldn't get through this whole article due to the dude in the corner staring at me... :-/

    document.getElementById('mugshot').remove()

Re: Ruby deploys temporarily disabled

#94

Post by saurik »

justsee wrote: post #88
saurik wrote: post #62

Earlier quoted context omitted.

You still wouldn't say "an why", as "w" isn't a vowel. If Anything, I can understand "an yamel" as more legitimate (as "y" is at least sort of a vowel).

No, "an YAML" is grammatically incorrect [0]. It's "a YAML". What's more annoying: the odd (and wrong) belief that "An green apple" is grammatically correct. [1] [0] http://english.stackexchange.com/questions/1016/do-you-use-a... [1] http://english.stackexchange.com/questions/152/when-should-i...

I didn't say that "an YAML" is correct; I was first correcting that "an YAML" would be correct if it were "an why aih ahm ell" (it wouldn't), and then went further into "if anything" land saying that "an yahmell" is at least something I can bring myself to say without feeling sick inside. ;P

Re: Ruby deploys temporarily disabled

#95

Post by cbhl »

quadhome wrote: post #89
1qaz2wsx3edc wrote: post #69

Earlier quoted context omitted.

Semi related CVEs aside (CVE-2013-0333 and CVE-2013-0156): YAML's security problems have been known for years by the community. YAML aside, don't trust user input. This is egg on rubygems's face and the ruby community. I don't think http://rubycentral.org/ has full-time staff for rubygems either. Gems, specifically should be signed. They are not, this type of exploit will continue to happen, hell, remember when githu…

How would signing gems have prevented this situation?

It would allow you to verify the authenticity of the gems, even if the server had been compromised.

(This isn't a new technique -- for example, .deb packages distributed through APT are usually signed with gpg -- IIRC, this was a measure introduced years ago in response to a Debian mirror being compromised.)

Re: Ruby deploys temporarily disabled

#96

Post by quadhome »

cbhl wrote: post #95
quadhome wrote: post #89

Earlier quoted context omitted.

How would signing gems have prevented this situation?

It would allow you to verify the authenticity of the gems, even if the server had been compromised. (This isn't a new technique -- for example, .deb packages distributed through APT are usually signed with gpg -- IIRC, this was a measure introduced years ago in response to a Debian mirror being compromised.)

(my knowledge is circa early 2000s)

Debian has (had?) a high barrier to entry to become a developer, and every developer signs their packages. The release binaries are arranged on a secured box and the release key itself is held by a limited set of people.

In short, the signatures work because of the human element and organizational structure of Debian.

Rubygems accepts submissions from the general public.

So, again, I don't see how it would have helped.

Re: Ruby deploys temporarily disabled

#97

Post by Xylakant »

rmc wrote: post #77
ikawe wrote: post #36

Earlier quoted context omitted.

Just to reiterate the parent: This is only valuable if we trust the signatures - which I wouldn't if they were, say, just held along side the "hacked" gems server.

I'm talking g about developers signing the archive on their local machine. Private key would be stored on developers laptop

You still need the public key to validate the signature. If the attacker can change the public key, he can change the signature without you knowing - unless you explicitly want to trust each and every key for every gem you install.

Re: Ruby deploys temporarily disabled

#98

Post by reybango »

Being totally new to RoR (trying to learn it), I'm trying to get my head around the scope of this.

When did the compromise happen? Was it compromised yesterday or only found out yesterday?

I have default gems installed on my system and haven't updated anything since the big Rails security issue that was reported a bit ago.

It'd be great to get some guidance on what to do.

Post reply on HN