Re:Giving up on Ruby packaging
by davidw on Sunday January 02, 2011 @09:34AM
(#2060064)
It's yet another way of installing software on my system. Currently I:
* Use apt-get for pretty much everything.
* Locally install a few project specific things. These often are installed locally, not system-wide, and have nothing to do with root.
* Use rubygems. It's nice, but I don't have the same level of confidence in it regarding security that I do about Debian and Ubuntu. It seems to just give me 'updates' to gems, without much of a way of knowing which updates are security fixes and which are simply improved versions of the packages in question.
RVM adds one more thing. And for each Ruby instance in there, I might have various versions of gems floating around. This does not make me happy from a security point of view.
* Use apt-get for pretty much everything.
* Locally install a few project specific things. These often are installed locally, not system-wide, and have nothing to do with root.
* Use rubygems. It's nice, but I don't have the same level of confidence in it regarding security that I do about Debian and Ubuntu. It seems to just give me 'updates' to gems, without much of a way of knowing which updates are security fixes and which are simply improved versions of the packages in question.
RVM adds one more thing. And for each Ruby instance in there, I might have various versions of gems floating around. This does not make me happy from a security point of view.