Re:Making popular Ruby packages more secure
by kayodelycaon on Monday June 13, 2022 @08:52PM
(#31733549)
> Dependency confusion attacks
Just want to point out that bundler solves this problem (and many others). It pins gem versions in Gemfile.lock and it supports explicit source locations (like git repositories) for downloading gems.
Just want to point out that bundler solves this problem (and many others). It pins gem versions in Gemfile.lock and it supports explicit source locations (like git repositories) for downloading gems.