Advanced

RubyGems is compromised

Posted by carlitos_esquer on · 3 comments
https://twitter.com/rubygems_status; By Carlitos Esquer 		Mail this story
Print this story

As of today the rubygems team has discovered a malicious gem pushed into rubygems.org, which may tampered some of the gems in the site...

Recomendations from the team leaders are not to deploy any new app which need to update or install gems from the site. Including Rails, Sinatra and other development kits...

The fixed versions are posted again into the site, and more information will be posted around tomorrow morning. By now the site is in read only mode...

Thanks for your appreciation!

  Nav
» Read more about: Groups: Ruby

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (3)

tracyanne ·
Any Ruby developers here
number6x ·
Yes.

Gems are software packages in ruby. Like using CPAN in Perl or using .deb's in debian.

I make sure to freeze my gems in production code, specifying the exact gem release. For example, I would require a gem called 'foo' to be at release 2.1.2, the release I tested and developed with.

You can specify a exact release, or you can specify that your code should require a release with a different measurement like greater than or equal to. 



source 'http://rubygems.org' 
# gems set to an exact release number:
gem 'foo', '2.1.2'
gem 'bar', '1.3.3'

# use any version of this gem that is greater than or equal to the specified number:
gem "baz",  ">=1.0"

# use any version of this gem that is greater than or equal to the specified number, 
# but don't go above the next major release number. 
# This will update to anything from 2.1 to 2.9.9, but will not go 3.x or above:
gem "qux",  "~>2.1"


In production code I always specify the exact release. I don't want my code to automagically update without being tested first. You never know what could break.

Thanks for the heads up. This came across all the user group feeds I get as well.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post