101–110 of 294 posts
I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism. I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like this is announced.
You can set up a system like Debian or Ubuntu to automatically install security updates.
Earlier quoted context omitted.
Getting continuous errors on deploy during the bundle stage like so: /usr/lib/ruby/1.9.1/rubygems/remote_fetcher.rb:215:in `fetch_http': bad response Not Found 404 (http://bb-m.rubygems.org/quick/Marshal.4.8/activesupport-3.2.11.gemspec.rz) Is this because rubygems.org is being nailed?
I'm getting exactly the same thing. Glad to know it's not just me.
Edit: finally got it out. This deploy model is completely screwed, though. It just shouldn't be normal to have a service like rubygems.org in the daily deploy loop. This is absolutely not a knock on the fantastic volunteers that run it - they simply shouldn't be dealing with this sort of load spike.
I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism. I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like this is announced.
You can set up a system like Debian or Ubuntu to automatically install security updates.
Earlier quoted context omitted.
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
Why is strong_parameters not the only way? Rails is pretty opinionated in many other respects...
Earlier quoted context omitted.
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
Why is strong_parameters not the only way? Rails is pretty opinionated in many other respects...
Earlier quoted context omitted.
You can set up a system like Debian or Ubuntu to automatically install security updates.
I'm guessing that might not work great considering last time I checked almost no one was using the debian packages due to antipathy between the debian maintainers and rubygems folks. Any know of any progress on that front?
I realize that providing an in-depth answer is tantamount to publishing an exploit how-to, but some reasonable way to privately test this would be very useful.
Maybe a "simple" URL tester hosted by a trusted Rails source (e.g. rubyonrails.org)? Ok, has the obvious issue of showing the world who they should target, but maybe you can riff on that theme?
Auditing and stuff you know. For some reason people in charge get really upset when all our base are belong to the bad guys.
Earlier quoted context omitted.
You can set up a system like Debian or Ubuntu to automatically install security updates.
I want my rails instances to shutdown within minutes of an announcement, not hours or days.
> Tens of Thousands of Rails Applications Remotely Disabled Following Rails.org Intrusion
I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!
Earlier quoted context omitted.
I want my rails instances to shutdown within minutes of an announcement, not hours or days.
Headline of the future: > Tens of Thousands of Rails Applications Remotely Disabled Following Rails.org Intrusion
The aftermath of an incident like the current one is a lot more expensive than an unplanned downtime.