jfire6

- friends
1,008 link karma
63 comment karma
send messageredditor for
what's this?

TROPHY CASE


  • Five-Year Club

Ruby 1.9.3-p194 is released, includes security fix for rubygems by burkein ruby

[–]jfire6 1 point2 points ago

RubyGems 1.8.23 is also out with the same fix.

Two security issues were fixed:

  • RubyGems did not validate SSL certificates (the dreaded OpenSSL::SSL::VERIFY_NONE problem).
  • RubyGems allowed HTTPS-to-HTTP redirects. And in fact rubygems.org did redirect gem downloads from HTTPS to HTTP (also fixed).

Either of these mean that an attacker could MITM your gem install or bundle install and give you malicious gem contents. You'd be owned when you required the gem -- possibly sooner, in fact, because gem install itself provides mechanisms for arbitrary code execution.

It's also important to note that RubyGems does not default to HTTPS. I highly recommend using source "https://rubygems.org" in your Gemfile and the following in your ~/.gemrc:

:sources:
  - https://rubygems.org

The famous "Horns of Paine" bathed in sunrise light, Torres del Paine National Park, Chile. [750x508]. © Ian Plant. by defabc456123in EarthPorn

[–]jfire6 -5 points-4 points ago

This is photoshopped. The foreground and background are two different photos.

source code to django project that runs everyblock.com released by TheKCGuyin Python

[–]jfire6 0 points1 point ago

sorry, this has been archived and can no longer be voted on

Yeah, I noticed they aren't using reverse() or the url template tag anywhere. Wonder why not.

view more: next