Ruby gems are still not safe to use • Hacker News Board

Re: Ruby gems are still not safe to use

#11

Post by FooBarWidget » Sat, Feb 02, 2013, 4:57 PM UTC

h_r wrote: post #8

Xylakant wrote: post #4

Earlier quoted context omitted.

I don't see the big gain in stopping to run code on install. By definition, we install gems to run code. If we don't trust the gem author not to mess with our system on install, how can we trust him not to mess with our system when we use the gem? Granted, there might be some people that install gems as root and run them as unprivileged user only, but even as a non-root user it's a problem to run code you don't trust…

Well... you would have to trust both the gem author and those who might have compromised an author's credentials. And my understanding is that the install can easily be running under a different set of credentials than normal use. (not a Ruby or Rails user here)

You don't need root to do serious damage. Even if you secure the gem installation process, the code inside the game can just do damage later. I think a signing system to prevent third party tampering of gems is the best that any developer packaging system can do.

Re: Ruby gems are still not safe to use

#12

Post by wildchild » Sat, Feb 02, 2013, 4:58 PM UTC

taf2 wrote: post #3

"Stop running code on gem install." - this is a real issue. I've used rpm shell execution to modify sshd as well as other system components in order "install" additional software. http://web.archive.org/web/20090211040821/http://www.idle-ha... as you can see from that archived post, it's very important to have trust of what you are installing. especially when you have to install with root permissions.... Seeing how m…

There is also Gemfile that can FileUtils#rm_rf

Re: Ruby gems are still not safe to use

#13

Post by PommeDeTerre » Sat, Feb 02, 2013, 5:06 PM UTC

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software.

I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development.

Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates.

Furthermore, the focus should not be on cranking out libraries and code as quickly as possible, especially when said code is rife with security holes.

There are many other programming languages, libraries and communities that take a far more sensible approach to software development. We see far fewer of these kinds of issues arise when things are not done the "Ruby" way.

Re: Ruby gems are still not safe to use

#14

Post by grandalf » Sat, Feb 02, 2013, 5:14 PM UTC

Even if 5% of the rubygems ecosystem contained malware, the biggest danger to most projects is the inclusion of gems that are sloppily maintained. Just because something is released as a gem does not mean it has good code quality or that good development practices were used to create it.

The default behavior of bundler is to grab the latest compatible gem version, and in many cases this breaks things bc of little or no QA on the part of some gem maintainers.

The top 10% of gems are well maintained but the rest should generally be avoided.

Re: Ruby gems are still not safe to use

#15

Post by phillc » Sat, Feb 02, 2013, 5:15 PM UTC

PommeDeTerre wrote: post #13

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

Your philosophies are sound for banking software.

There are cases where startups, social impact organizations, or any fast moving team would pick rails for its fast movement, accessibility, and support, even if they thought that there were even more security issues than that have happened.

Re: Ruby gems are still not safe to use

#16

Post by BSousa » Sat, Feb 02, 2013, 5:15 PM UTC

PommeDeTerre wrote: post #13

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

Do you suggest an alternative? That works on Mac/Linux.

Is Python/Django that much secure or just not targeted enough?

I'm evaluating languages/frameworks for a project and I really want to use Haskell and yesod or happstack, but after starting my project in them, I always end up going back to Rails for the documentation/ease. I may try and stick to it this time but any suggestions would be great.

Re: Ruby gems are still not safe to use

#17

Post by PommeDeTerre » Sat, Feb 02, 2013, 5:25 PM UTC

phillc wrote: post #15

PommeDeTerre wrote: post #13

Earlier quoted context omitted.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

Your philosophies are sound for banking software. There are cases where startups, social impact organizations, or any fast moving team would pick rails for its fast movement, accessibility, and support, even if they thought that there were even more security issues than that have happened.

That's a very dangerous attitude to have.

Security is not something that should be traded off just to reduce development time or effort slightly.

Regardless of the situation, it's much more responsible to focus on doing security properly, while cutting corners on the UI, documentation or other less-critical areas of the application. Those are generally the kind of updates that can wait a little while. Implementing proper security should not be done via updates or patches "later on" in the project.

Re: Ruby gems are still not safe to use

#18

Post by nicholasjarnold » Sat, Feb 02, 2013, 5:26 PM UTC

Is it safe to install rails with something like 'gem install rails' right now? I'm totally new to Ruby and to the Rails framework, but I was going to start a side project with it this weekend (today). Any advice on how I can safely get setup while the community is figuring out how to cope with the intrusion?

Re: Ruby gems are still not safe to use

#19

Post by knowtheory » Sat, Feb 02, 2013, 5:31 PM UTC

PommeDeTerre wrote: post #13

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now.

You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes.

Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things be fixed within the Ruby community? Yes.

So if you want to advocate that people shouldn't use Ruby or Rails, fine, your prerogative. But please, stop being an asshole while doing it.

Re: Ruby gems are still not safe to use

#20

Post by oscardelben » Sat, Feb 02, 2013, 5:31 PM UTC

nicholasjarnold wrote: post #18

Is it safe to install rails with something like 'gem install rails' right now? I'm totally new to Ruby and to the Rails framework, but I was going to start a side project with it this weekend (today). Any advice on how I can safely get setup while the community is figuring out how to cope with the intrusion?

yes, all gems have been verified.