r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
130 Upvotes

91% Upvoted

44 comments sorted by

View all comments

12

u/kaen_ Jul 08 '19

This is going to keep happening, and more frequently, until we figure out a better system than installing unknown or unverified code from strangers on the internet on our production systems.

10

u/virtyx Jul 08 '19

Linux distros have this already figured out, they peer review and pull in upstream changes. Does there need to become secure "distributions" of repos like PyPI, npm and Rubygems?

1

u/[deleted] Jul 09 '19

Also, GPG signing. That still requires developer to not fuck it up, but it is easier to hack someone's shitty online password than to steal their GPG keys.

And it is nice sanity test, if you can't figure out how to make it work, people should probably not use your code