RubyGems.org gem replacement security vulnerability and mitigation • Hacker News Board

Re: RubyGems.org gem replacement security vulnerability and mitigation

#21

Post by dcu » Thu, Apr 07, 2016, 1:11 PM UTC

revorad wrote: post #16

dcu wrote: post #4

I just wrote a simple script to check the gems: https://gist.github.com/dcu/3c06e4ab0e98158c5742c4fd2b31523d

Thanks for this. So I ran this and found a bunch of unsafe gems. Do I report them to each gem author or to RubyGems security?

I think we should ask the gem owner to verify that everything is ok unless there's a new version. I updated the script to report if there is a new safe version available.

Re: RubyGems.org gem replacement security vulnerability and mitigation

#22

Post by derekprior » Thu, Apr 07, 2016, 1:22 PM UTC

The manual verification steps are basically impossible for any non-trivial gem. I wonder if it would be possible to re-build (from git) the impacted gem versions and check their checksum against the downloaded version to detect differences?

Re: RubyGems.org gem replacement security vulnerability and mitigation

#23

Post by hellbanner » Fri, Apr 08, 2016, 9:12 PM UTC

FooBarWidget wrote: post #8

colanderman wrote: post #7

Earlier quoted context omitted.

Reliable, secure package management systems have existed for a long time [1] [2] [3]. Ruby, Node, Python, et al. just choose to ignore them, just like they choose to ignore other proven development tools [4]. [1] https://debian-handbook.info/browse/stable/sect.package-auth... [2] https://access.redhat.com/security/team/key/ [3] https://wiki.archlinux.org/index.php/DeveloperWiki:Package_s... [4] https://en.wikipedia.o…

Sigh, I know that it's easy to paint an outside group of programmers as incompetent fools who choose to ignore the Obvious Solutions(tm), but how many times must this be discussed before people realize that distribution package managers cannot replace the language-specific package systems? Language-specific package systems have requirements which distribution package managers like apt/dpkg, rpm/yum, pacman etc do not…

Thanks for your excellent reply. Do you think support for Nix, Guix etc will increase, or will reliable package systems only become more fragmented?

I do remember seeing a Linux variant announce they had achieved full trusted compilation a while back (on HN), which was pleasant to see but sadly too rare.

Re: RubyGems.org gem replacement security vulnerability and mitigation

#24

Post by brightshiny » Sat, Apr 09, 2016, 3:58 AM UTC

dcu wrote: post #4

I just wrote a simple script to check the gems: https://gist.github.com/dcu/3c06e4ab0e98158c5742c4fd2b31523d

Thanks for this. I did some extra work on it (via someone else's fork) so it can run across multiple directories. I've too many projects lurking around to cd into all of them! I added some pretty colours too :)

https://gist.github.com/yb66/44b97baecbeec6900e039ffb9461d31...