Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby gems are still not safe to use

cristianobetta.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Ruby gems are still not safe to use

#21

Post by PommeDeTerre »

knowtheory wrote: post #19
PommeDeTerre wrote: post #13

Earlier quoted context omitted.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes?

Will they do the responsible thing and throw out all of the existing, poorly-written code?

Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start?

Will they throw out their flawed development philosophies, so that they don't get into the same situation later on?

I'm unfortunately inclined to think that we'll just see more of the same. These problems will be "patched" over, at best, rather than fixed at the root. In fact, proper fixing of these issues would go against everything that the Ruby community stands for.

That's why I think that moving away from Ruby and Ruby on Rails is a responsible approach. Some problems just can't be fixed, and I think we've encountered some of those in this situation.

Re: Ruby gems are still not safe to use

#22

Post by nicholasjarnold »

oscardelben wrote: post #20
nicholasjarnold wrote: post #18

Is it safe to install rails with something like 'gem install rails' right now? I'm totally new to Ruby and to the Rails framework, but I was going to start a side project with it this weekend (today). Any advice on how I can safely get setup while the community is figuring out how to cope with the intrusion?

yes, all gems have been verified.

Thank you.

Re: Ruby gems are still not safe to use

#23

Post by cglee »

PommeDeTerre wrote: post #17
phillc wrote: post #15

Earlier quoted context omitted.

Your philosophies are sound for banking software. There are cases where startups, social impact organizations, or any fast moving team would pick rails for its fast movement, accessibility, and support, even if they thought that there were even more security issues than that have happened.

That's a very dangerous attitude to have. Security is not something that should be traded off just to reduce development time or effort slightly. Regardless of the situation, it's much more responsible to focus on doing security properly, while cutting corners on the UI, documentation or other less-critical areas of the application. Those are generally the kind of updates that can wait a little while. Implementing pr…

There's always a tradeoff between security and other variables. There's no such thing as 100% secure, so where you make your stake in the spectrum of security depends on your business domain. Just as you have different engineering requirements when building a spaceship vs a prius, you have different software practices for different types of projects.

Re: Ruby gems are still not safe to use

#24

Post by wyuenho »

BSousa wrote: post #16
PommeDeTerre wrote: post #13

Earlier quoted context omitted.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

Do you suggest an alternative? That works on Mac/Linux. Is Python/Django that much secure or just not targeted enough? I'm evaluating languages/frameworks for a project and I really want to use Haskell and yesod or happstack, but after starting my project in them, I always end up going back to Rails for the documentation/ease. I may try and stick to it this time but any suggestions would be great.

Python.org's been targeted quite enough alright[1].

PyPI is arguably more secure though the surrounding implementations are spotty. You can at least verify the package uploader's identity with some certainty using PyPISSH[2], and sign your package with GPG[3]. The problem is, PyPISSH and signing your package with GPG are not required for compatibility reasons.

[1]: http://wiki.python.org/moin/WikiAttack2013

[2]: http://pypi.python.org/pypi/pypissh

[3]: http://pypi.python.org/security

Re: Ruby gems are still not safe to use

#25

Post by Xylakant »

h_r wrote: post #8
Xylakant wrote: post #4

Earlier quoted context omitted.

I don't see the big gain in stopping to run code on install. By definition, we install gems to run code. If we don't trust the gem author not to mess with our system on install, how can we trust him not to mess with our system when we use the gem? Granted, there might be some people that install gems as root and run them as unprivileged user only, but even as a non-root user it's a problem to run code you don't trust…

Well... you would have to trust both the gem author and those who might have compromised an author's credentials. And my understanding is that the install can easily be running under a different set of credentials than normal use. (not a Ruby or Rails user here)

It's more standard to have rails apps run under a dedicated and lower privileged user than not. It's also a common option to use vendored dependencies for a variety of reasons: You (a) avoid conflicts with other installed gems on the system and (b) don't need elevated privileges to install the app. But let's not just talk about rails: There's a ton of tools that use ruby to manage stuff, some of them running as root by default - both chef and puppet are written in ruby and sometimes distributed as gems. In any case, they use gems. So all it needs is to have one binary exploited to start a shell and then you have an entry point from where you can escalate privileges and obtain root. So if you don't trust rubygems you can't install anything in ruby.

Re: Ruby gems are still not safe to use

#26

Post by knowtheory »

PommeDeTerre wrote: post #21
knowtheory wrote: post #19

Earlier quoted context omitted.

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes? Will they do the responsible thing and throw out all of the existing, poorly-written code? Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start? Will they throw out their flawed development philosophies, so that t…

Yeah, see, you can't put the name calling aside. That's what i'm telling you.

Regardless of the merits of a discussion regarding security, open source software, and the ruby community, it's clear that you have an axe to grind, and are not participating in this conversation in a constructive manner.

There is no point in engaging you in a discussion about Ruby security, because you just want people to stop using Ruby. Again, that's your prerogative, but don't try to dress it up as your overwhelming concern for security.

The practical matter is that folks are going to continue using Ruby with 100% certainty for the short term.

So if you were actually interested in security, rather than trolling or gloating, you could actually comment on the technical matters under discussion, instead of just telling people "stop using ruby" and that the "proper fixing of these issues would go against everything that the Ruby community stands for."

Re: Ruby gems are still not safe to use

#27

Post by moe »

PommeDeTerre wrote: post #21
knowtheory wrote: post #19

Earlier quoted context omitted.

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes? Will they do the responsible thing and throw out all of the existing, poorly-written code? Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start? Will they throw out their flawed development philosophies, so that t…

I see your comments on every Ruby-related thread and you sound like a broken record.

Many of us Ruby-users see the problems in a similar way and try to fix them. It's a learning process and it happens right now. The ruby community is also not an uniform blob. We are not 37signals and we are not the rubygems team. Many of us disagree with some decisions made at these places. Most of us also use other languages and are well aware of the trade-offs that Ruby implies.

This is all worth discussing and the specific problems are worth fixing. The rubygems-team happens to be working on their problem, which is a hard problem, right now; https://gist.github.com/4696144

Your mindless bashing on every Ruby HN-thread contributes nothing. Please use your time for something more productive, e.g. you could go to your preferred language community and help them fix their security problems, which they also have plenty of.

Re: Ruby gems are still not safe to use

#28

Post by curcumin »

This hyperbole is very silly! Weaknesses appear in everything when it becomes popular.

There needs to be something like the "app store" and I don't mean specifically apples' own.

But we need some of the big corps using ROR to step forward and provide complete support for this type of project.

Re: Ruby gems are still not safe to use

#29

Post by Xylakant »

PommeDeTerre wrote: post #21
knowtheory wrote: post #19

Earlier quoted context omitted.

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes? Will they do the responsible thing and throw out all of the existing, poorly-written code? Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start? Will they throw out their flawed development philosophies, so that t…

Ok, serious question: In which ways is rubygems less safe than .deb packages, .rpms, portfiles or ebuilds, python eggs, jars or composer files? All of those are mechanisms to distribute and deploy code. All of those suffer from the same basic vulnerability: They ship code that gets executed. If that code gets compromised, you have a viable attack. Debian saw its developer repositories compromised at least in 2006 [1] and back then, we had the same problem: In the beginning nobody was sure whether the package repositories had been attacked.

There is one critical difference between OS package repos and the programming language repos: For an OS package repo, signing is mandatory. Programming language repos allow that, but don't enforce it. Python is a little ahead here, but this is nothing that can't be fixed. I actually see that gem signing will be mandatory in the foreseeable future.

[1] http://www.debian-administration.org/articles/417

Re: Ruby gems are still not safe to use

#30

Post by wyuenho »

moe wrote: post #27
PommeDeTerre wrote: post #21

Earlier quoted context omitted.

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes? Will they do the responsible thing and throw out all of the existing, poorly-written code? Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start? Will they throw out their flawed development philosophies, so that t…

I see your comments on every Ruby-related thread and you sound like a broken record. Many of us Ruby-users see the problems in a similar way and try to fix them. It's a learning process and it happens right now. The ruby community is also not an uniform blob. We are not 37signals and we are not the rubygems team. Many of us disagree with some decisions made at these places. Most of us also use other languages and are…

I'd reeeaally like to see a second group of dedicated maintainers that are more concerned about security to step up to the plate, fast. The guys behind Ronin are doing great, but they are really just 2 guys battling against a community which have a track record of producing a code base that has had 8 code execution and 8 SQL injection vulnerabilities so far.

http://www.cvedetails.com/product/22569/Rubyonrails-Rails.ht...

http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-...

Post reply on HN