Ruby gems are still not safe to use • Hacker News Board

Re: Ruby gems are still not safe to use

#31

Post by slurry » Sat, Feb 02, 2013, 6:35 PM UTC

knowtheory wrote: post #19

PommeDeTerre wrote: post #13

Earlier quoted context omitted.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Sometimes trolling is not false.

You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes.

His generalizations fit well enough to include the dev teams of the core package management system and the by-far predominant application framework. As broad generalizations go that's a pretty effective reach.

Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah.

Yeah.

Do things need to be fixed? Yes.

Yes.

Can these things be fixed within the Ruby community? Yes.

Woah, hold your horses there. Can they be fixed within a Ruby community? Yes. Can they be fixed within the community as it now stands, with its present culture and practices? I would hesitate before answering yes.

But please, stop being an asshole while doing it.

Turned out Walter was right, in the end. She did kidnap herself.

Re: Ruby gems are still not safe to use

#32

Post by mark_l_watson » Sat, Feb 02, 2013, 6:51 PM UTC

Sorry in advance for being off topic, but: I rely a lot on Clojure repos like clojars.org and I in addition to checking my few Rails and Sinatra apps in the last few days, I have become a little concerned about the same sort of thing happening with clojars, main mavin repos, etc.

Re: Ruby gems are still not safe to use

#33

Post by knowtheory » Sat, Feb 02, 2013, 7:05 PM UTC

slurry wrote: post #31

knowtheory wrote: post #19

Earlier quoted context omitted.

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

Sometimes trolling is not false. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. His generalizations fit well enough to include the dev teams of the core package management system and the by-far predominant application framework. As broad generalizations go that's a pretty effective reach. Has the compromise of Rubygems been an event of such mas…

Right, so it's perfectly possible to be both right, and an asshole.

I don't begrudge people being right (although, I also don't happen to think that Mr. Potato there is totally correct). I do however have a problem with people being jerks.

Moreover, being right does not give someone license to be a jerk either.

-----------------------------

As for the substance, yeah I do think there are ways to secure Ruby gems better, and I think that given the way the Ruby community is organized (since it's not a monolith), there are paths forward that can be organized and implemented by smart and interested rubyists, and those paths can and will be adopted by the bulk of developers who aren't as engaged in the Ruby ecosystem.

Re: Ruby gems are still not safe to use

#34

Post by [deleted] » Sat, Feb 02, 2013, 7:21 PM UTC

knowtheory wrote: post #19

PommeDeTerre wrote: post #13

Earlier quoted context omitted.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

I'm loathe to engage in more negativity, but dude, you're just engaging in software-bigotry and trolling now. You're making broad generalizations about the ruby community and it's members, many of whom do not fit your stereotypes. Has the compromise of Rubygems been an event of such massive proportion that it effects all ruby devs and those who rely upon them? Yeah. Do things need to be fixed? Yes. Can these things b…

[deleted]

Re: Ruby gems are still not safe to use

#35

Post by rimantas » Sat, Feb 02, 2013, 7:36 PM UTC

PommeDeTerre wrote: post #13

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

  > We see far fewer of these kinds of issues arise when
  > things are not done the "Ruby" way.

But not because other ways are safer and products are safe. They are just not as interesting for the HN crowd.

Re: Ruby gems are still not safe to use

#36

Post by static_typed » Sat, Feb 02, 2013, 7:53 PM UTC

PommeDeTerre wrote: post #13

qrush wrote: post #5

The call to action in this post is not strong enough - RubyGems and RubyGems.org are completely volunteer-run, open source projects. If you want to fix these problems, please get involved and stick around.

Another approach is to completely move away from using Ruby, Ruby on Rails and related software. I think that the recent security issues are evidence of many systemic problems within the Ruby community, and with their approach and attitude toward software development. Security should be inherent and considered from the very start, rather than brought on over time by an endless stream of patches and updates. Furthermo…

Finally someone else gets it.

Security is not solved by a gem install makerailsmadsecurer.

Security is a process, and it does not stop.

How many people install gems happily without really understanding what it actually permits? Especially when run as root? How many people understood the always-on, Yaml parser approach that has been responsible for some of the recent security issues in Ruby land?

Given it is possible to write secure software and frameworks, why don't we see this in Ruby land?

Re: Ruby gems are still not safe to use

#37

Post by detst » Sat, Feb 02, 2013, 8:09 PM UTC

knowtheory wrote: post #26

PommeDeTerre wrote: post #21

Earlier quoted context omitted.

Your name-calling aside, how do you propose that the Ruby community deal with these inherent problems with their software and their attitudes? Will they do the responsible thing and throw out all of the existing, poorly-written code? Will they collectively ditch RubyGems in favor of a system that has some modicum of security built in from the start? Will they throw out their flawed development philosophies, so that t…

Yeah, see, you can't put the name calling aside. That's what i'm telling you. Regardless of the merits of a discussion regarding security, open source software, and the ruby community, it's clear that you have an axe to grind, and are not participating in this conversation in a constructive manner. There is no point in engaging you in a discussion about Ruby security, because you just want people to stop using Ruby.…

You might want to stop and consider who's "not participating in this conversation in a constructive manner". You've called him a "software-bigot", "troll", "jerk" and "asshole". You seem to be taking his valid criticism personally. I've re-read the post and cannot see your motivation for the name calling.

The Ruby community may come out of this better and stronger but it's quite valid to suggest that some people may be better off moving on.

Re: Ruby gems are still not safe to use

#38

Post by ef4 » Sat, Feb 02, 2013, 8:17 PM UTC

Worrying about code execution at install is silly. The whole point of installing a gem is to download code that you're going to execute.

So the whole gem (install code and runtime code) needs to be trusted, and should be verifiably signed by somebody you can trust.

Re: Ruby gems are still not safe to use

#39

Post by Turing_Machine » Sat, Feb 02, 2013, 8:25 PM UTC

ef4 wrote: post #38

Worrying about code execution at install is silly. The whole point of installing a gem is to download code that you're going to execute. So the whole gem (install code and runtime code) needs to be trusted, and should be verifiably signed by somebody you can trust.

Right. Some of these are legitimate issues, but not that one.

Given that the Ruby code in the gem has full access to the file system with the privileges of whoever is running it, I don't see how this makes things any worse (assuming you're not installing the gems as root or whatever).

Re: Ruby gems are still not safe to use

#40

Post by knowtheory » Sat, Feb 02, 2013, 8:28 PM UTC

detst wrote: post #37

knowtheory wrote: post #26

Earlier quoted context omitted.

Yeah, see, you can't put the name calling aside. That's what i'm telling you. Regardless of the merits of a discussion regarding security, open source software, and the ruby community, it's clear that you have an axe to grind, and are not participating in this conversation in a constructive manner. There is no point in engaging you in a discussion about Ruby security, because you just want people to stop using Ruby.…

You might want to stop and consider who's "not participating in this conversation in a constructive manner". You've called him a "software-bigot", "troll", "jerk" and "asshole". You seem to be taking his valid criticism personally. I've re-read the post and cannot see your motivation for the name calling. The Ruby community may come out of this better and stronger but it's quite valid to suggest that some people may…

Right, so this is why I was loathe to call Potato out.

If you take a look at his comments he's been all over these threads about ruby: https://news.ycombinator.com/threads?id=PommeDeTerre

And he really isn't participating in a constructive manner. He gets away with his obnoxious behavior in other threads by intermingling his opinions and generalizations in with the substantive discussion.

I'm not going to engage him on the substance of what's happening in the Rubysphere, because he has made clear that he no intention of helping either move the discussion along, or to solve any problems.

That he occasionally raises legitimate points is irrelevant, others have raised the same points in constructive manners, and there have been fruitful discussions on the topics. Engaging this particular guy is only feeding a troll who is distracting from the conversation.

Regretfully there are two opposing goals that must be served here.

The discussion about how Rubygems is going to move forward is really of vital importance to the ruby community. Making sure that there is a civic engagement with Rubygems and the tooling that Rubyists rely on is something that really does need to be promoted better.

On the other hand, Pomdeterre's trolling is obnoxious and unhealthy behavior that HN shouldn't tolerate. Like I said above. Being right is important, but it's not the only important thing. You can be right and still be an asshole who's being a drag on a community, or an organized effort to do something.

I agree that my criticism of PomDeTerre's behavior does not touch on the heart of the discussion, but I hope you can understand that that was in fact the intention. It is not the subject matter that he is discussing that's the problem. It is his conduct.

It's unfortunate that it's distracting from the substantive discussion, but we shouldn't have to put up with people acting like this, or interfering with efforts to fix problems.