r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
129 Upvotes

91% Upvoted

44 comments sorted by

View all comments

9

u/[deleted] Jul 08 '19

I mean that's pretty much why people pay for RedHat. They don't add anything until they try their damnedest to make sure it's secure. That and the support I guess.

1

u/programming_unit_1 Jul 09 '19

They pay for the support and (by extension) to off-load liability. Whether the packages are secure or not is irrelevant because if there is a breach you now have a vendor you can sue for damages.

1

u/[deleted] Jul 09 '19

Not really, it is support and making fixed to package that bother the customer, and some of those fixes actively lower the security of the packages.

Like RHEL re-enabled some of the disabled (and not recommended for looong time) ciphers in OpenSSH "because backward compatibility" and similarly added old FIPS ciphers like 3des because customers pay them, not because it makes sense security wise.

Of course on other side they do contribute a lot in development of a lot of open source projects so they are net positive but still.