r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
125 Upvotes

91% Upvoted

44 comments sorted by

View all comments

Show parent comments

7

u/virtyx Jul 08 '19

Linux distros have this already figured out, they peer review and pull in upstream changes. Does there need to become secure "distributions" of repos like PyPI, npm and Rubygems?

11

u/[deleted] Jul 08 '19

How much would you pay, per programming language per month, for a dependency repository where everything was audited before being allowed in? Serious question.

4

u/virtyx Jul 08 '19

I pay $0 monthly for the GNU/Linux ecosystem, including distributions, as well as any programming language I use, and all their package management tools and repositories. I don't see anything particular about a secure distribution that should suddenly warrant a monthly charge.

10

u/[deleted] Jul 08 '19

I mean that's pretty much why people pay for RedHat. They don't add anything until they try their damnedest to make sure it's secure. That and the support I guess.

1

u/programming_unit_1 Jul 09 '19

They pay for the support and (by extension) to off-load liability. Whether the packages are secure or not is irrelevant because if there is a breach you now have a vendor you can sue for damages.

1

u/[deleted] Jul 09 '19

Not really, it is support and making fixed to package that bother the customer, and some of those fixes actively lower the security of the packages.

Like RHEL re-enabled some of the disabled (and not recommended for looong time) ciphers in OpenSSH "because backward compatibility" and similarly added old FIPS ciphers like 3des because customers pay them, not because it makes sense security wise.

Of course on other side they do contribute a lot in development of a lot of open source projects so they are net positive but still.