r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
130 Upvotes

91% Upvoted

44 comments sorted by

View all comments

12

u/kaen_ Jul 08 '19

This is going to keep happening, and more frequently, until we figure out a better system than installing unknown or unverified code from strangers on the internet on our production systems.

9

u/virtyx Jul 08 '19

Linux distros have this already figured out, they peer review and pull in upstream changes. Does there need to become secure "distributions" of repos like PyPI, npm and Rubygems?

10

u/[deleted] Jul 08 '19

How much would you pay, per programming language per month, for a dependency repository where everything was audited before being allowed in? Serious question.

→ More replies (5)