7 ms·
Which brings us to the old saying: Do not deserialize untrusted data. In the context of Rubygems and their specs this obviously is harder to manage but depende
by sebiw 1mo ago
Which brings us to the old saying: Do not deserialize untrusted data.
In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.
- sscaryterry 1mo ago> dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base This mindset is changing, in the npm ecosystem, managing and updating dependencies have become somewhat of a gamble. It is no longer if, its when you are compromised.
- _joel 1mo agoChecksumming the dependencies in the Gemfile may help. https://blog.rubygems.org/2024/12/19/bundler-v2-6.html https://blog.rubygems.org/2024/12/19/bundler-v2-6.html
- rjsw 1mo agoI have to use several gems that download and compile C sources from github at install time.
- manewitz 1mo agoGemfile.lock checksums by default on bundler 4+
- sscaryterry 1mo agoAccounts get compromised, no checksumming in the world can help with that.
- jbverschoor 1mo agoGems/packages should explicitly declare what kind of features they need/want (file, net, deserialization, execute) And when the sig. changes, you should get a warning Very similar to the iOS entitlements
- wyager 1mo ago> Do not deserialize untrusted data. I think the better lesson is "use safe codecs"
- ares623 1mo agoLLMs: hold my beer