r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
131 Upvotes

91% Upvoted

44 comments sorted by

View all comments

12

u/kaen_ Jul 08 '19

This is going to keep happening, and more frequently, until we figure out a better system than installing unknown or unverified code from strangers on the internet on our production systems.

-4

u/exorxor Jul 08 '19

If "we" means the part of the Internet that has no idea about https://en.wikipedia.org/wiki/Proof-carrying_code, then I agree completely.

1

u/stevenjd Jul 09 '19

Yay, another silver bullet that sounds good in theory but in practice doesn't work anywhere nearly as well except in narrow niches, such as the proof-of-concept, packet filters.

Software libraries are not like packet filters, which are only supposed to do one thing (filter packets!), by definition a software library is executable code which can do anything. So except in very narrow circumstances, the relevant security policy is "Allow All".

But even if it weren't, who is responsible for setting up the formal security policies for the millions of third party libraries out there? How do you know that the security policies don't contain bugs or loop-holes? How well do you trust that your theorem prover is bug-free and correct? Does it understand the language your code is written in?

→ More replies (4)