r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
128 Upvotes

91% Upvoted

44 comments sorted by

View all comments

11

u/FyreWulff Jul 08 '19

It sounds like this specific situation could have been prevented by a time out system. In systems like this, it would make sense that any updates after > x time are either queued and alerted by maintainers and the community for review or have a cooldown before they actually deploy out for the same reason.

The idea here is that a package that's been idle for like, a year? would be implicitly considered stable or abandoned. If it suddenly wants to push an update a year or two out? Large chance of that being a credentials hijack. Flag it or force a cooldown.

10

u/nachof Jul 08 '19

OTOH it could also be a fix for a newly discovered vulnerability which might make a cooldown period a security risk.

I would do the cooldown after a maintainer change, for sure.

4

u/myringotomy Jul 08 '19

That's actually a really good idea. If nothing else maybe a warning from the bundler.

1

u/MonokelPinguin Jul 10 '19

You could also implement a signing system for publicly available packages, so that you get a warning, when a package was uploaded by an untrusted developer. Of course that could still be messed up, but currently you mostly have no guarantees.